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INSPECTOR  GENERAL 
DEPARTMENT  OF  DEFENSE 
400  ARMY  NAVY  DRIVE 
ARLINGTON,  VIRGINIA  22202-4704 


October  24,  2002 

MEMORANDUM  FOR  UNDER  SECRETARY  OF  DEFENSE  FOR  ACQUISITION, 

TECHNOLOGY,  AND  LOGISTICS 

SUBJECT:  Report  on  the  Fuel  Cells  of  the  V-22  Osprey  Joint  Advanced  Vertical 
Aircraft  (Report  No.  D-2003-013) 


We  are  providing  this  report  for  information  and  use.  This  audit  resulted  from 
an  allegation  concerning  the  crashworthiness  of  the  fuel  cells  or  tanira  installed  on  the 
V-22  Osprey.  We  considered  management  comments  on  a  draft  of  this  report  when 
preparing  the  final  report. 

Management  comments  on  the  draft  of  this  report  conformed  to  the 
requirements  of  DoD  Directive  7650.3  and  left  no  unresolved  issues.  Therefore,  no 
additional  comments  are  required. 

We  appreciate  the  courtesies  extended  to  the  staff.  Questions  should  be  directed 
to  Mr.  John  E.  Meling  at  (703)  604*9091  (DSN  664-9091)  (jmeling@dodig.  osd.mil)  or 
Mr.  Jack  D.  Snider  at  (703)  604-9087  (DSN  664-9087)  (jsnldM@dodig.osd.mil).  See 
Appendix  O  for  the  report  distribution.  The  team  members  are  listed  inside  the  back 
cover. 


David  K.  Steensma 
Deputy  Assistant  Inspector  General 
for  Auditing 


Office  of  the  Inspector  General  of  the  Department  of  Defense 


Report  No.  D-2003-013  October  24,  2002 

(Project  No.  D2002AE-0065.001) 

Fuel  Cells  of  the  V-22  Osprey  Joint 
Advanced  Vertical  Aircraft 

Executive  Summary 

Who  Should  Read  This  Report  and  Why?  This  report  should  be  read  by  all  who  are 
interested  in  Marine  Corps  aviation,  DoD  acquisition  processes,  and  aviation  safety.  The 
report  discusses  fuel  cell  safety  considerations  for  the  V-22  Osprey  Joint  Advanced 
Vertical  Aircraft  (V-22)  used  for  flight  testing. 

Background.  This  audit  resulted  from  allegations  referred  to  the  Office  of  the  Inspector 
General  of  the  Department  of  Defense  by  the  Commandant  of  the  Marine  Corps  on 
December  27,  2001.  Of  those  allegations,  four  concerned  the  crashworthiness  of  the  fuel 
cells  or  tanks  installed  on  the  V-22.  Specifically,  it  was  alleged  by  a  Marine  aviator  that: 

•  the  fuel  cell  installed  in  the  V-22  was  not  able  to  withstand  the  required 
lOg  (gravitational  acceleration)  impact; 

•  a  fuel  cell  that  could  withstand  the  impact  was  developed  but  not  installed 
because  of  structural  issues  affecting  the  weight  of  the  aircraft; 

•  the  V-22  design  could  have  incorporated  breakaway  fuel  cells,  which  break 
away  on  impact  to  prevent  fires  and  explosions,  but,  instead,  incorporated  fuel 
cells  that  will  burst  and  flood  the  cabin  with  fuel;  and 

•  because  the  V-22  fuel  cells  did  not  pass  the  drop  test,  the  V-22  fuel  cell 
standards  were  lowered  to  incorporate  a  cell  design  that  would  work  and  still 
maintain  a  weight  savings. 

Appendix  B  of  this  report  covers  those  four  allegations.  The  Office  of  the  Inspector 
General  of  the  Department  of  Defense  addressed  the  other  allegations  in  a  separate  report, 
dated  August  19,  2002. 

On  May  29,  2002,  the  Navy  restarted  engineering  and  manufacturing  development  (EMD) 
flight  testing  of  the  V-22  aircraft.  As  of  October  2002,  the  program  was  in  low-rate  initial 
production.  The  Under  Secretary  of  Defense  for  Acquisition,  Technology,  and  Logistics 
(the  Under  Secretary)  has  not  determined  a  date  for  the  full-rate  production  decision. 

Results.  Safety  risks  for  V-22  flight  testing  were  not  minimized  because  V-22  aircraft  in 
use  for  EMD  flight  testing  have  noncrashworthy  fuel  cells.  The  V-22  fuel  cells  in  the 
sponsons  for  the  4  EMD  aircraft,  the  aft  fuel  cell  in  the  right  fuselage  sponson  for  the 
12  low-rate  initial  production  aircraft  in  Lots  1  and  2,  and  all  fuel  cells  in  the  fuselage 
sponsons  for  the  7  low-rate  initial  production  aircraft  in  Lot  3  did  not  meet 
crashworthiness  standards.  Further,  the  V-22  fuel  cells  in  the  EMD  aircraft  and  in  the 
low-rate  initial  production  aircraft  in  Lots  1,2,  and  3  did  not  meet  ballistic  live-fire 
requirements.  For  subsequent  lots,  the  contractor  developed  sponson  fuel  cells  that  meet 
crashworthiness  and  ballistic  requirements.  The  V-22  Program  Office  plans  to  install 
those  compliant  fuel  cells  at  an  average  cost  to  the  Government  of  about  $512,000  per 
aircraft  on  the  17  remaining  low-rate  initial  production  aircraft  from  Lots  1  through  3. 


However,  the  V-22  Program  Office  does  not  plan  to  install  crashworthy  sponson  fuel  cells 
on  V-22  aircraft  used  for  EMD  testing.  As  a  result,  the  safety  risk  to  aircrews  of  those 
aircraft  will  not  be  minimized  if  the  aircraft  are  not  retrofitted  before  further  flight  testing. 

The  Navy  did  not  approve  retrofitting  the  EMD  aircraft  with  crashworthy  fuel  cells  to 
minimize  aircrew  risk  because  those  aircraft  would  be  used  only  for  flight  testing. 
Consequently,  on  March  15,  2002,  we  requested  that  the  Under  Secretary  determine 
whether  the  risk  of  flying  the  EMD  aircraft  with  noncrashworthy  fuel  cells  was  acceptable. 
On  April  3,  2002,  the  Under  Secretary  responded,  stating  that  the  benefits  of  returning  to 
flight  as  scheduled  to  address  other  technical  concerns  outweighed  the  limited  risk 
reduction  attained  by  retrofitting  the  aircraft  with  crashworthy  fuel  cells.  The  Under 
Secretary  also  stated  that  he  agreed  with  the  assessment  by  the  Commander,  Naval  Air 
Systems  Command  that  the  risk  of  conducting  developmental  testing  with  noncrashworthy 
fuel  cells  was  within  manageable  flight  test  boundaries  and  with  the  Commander’s  decision 
to  return  to  developmental  testing  with  aircraft  having  noncrashworthy  fuel  cells.  The 
Commander  cited  a  system  safety  assessment  of  the  V-22  as  part  of  the  basis  for  his 
decision;  however,  the  V-22  Program  Office  and  Boeing  were  not  able  to  provide  us  with 
documentation  that  supported  the  system  safety  risk  assessment. 

On  May  28,  2002,  in  response  to  an  informal  recommendation,  the  Under  Secretary  stated 
that  the  Navy  had  now  formally  documented  its  risk  assessment  process.  However,  when 
the  Under  Secretary  made  his  decision,  the  risk  assessment  was  not  supported  by 
documentation  and  the  methodology  used  was  flawed.  On  June  7,  2002,  we  informed  the 
Under  Secretary  that  the  risk  assessment  raised  a  fundamental  question  concerning  the 
evaluation  methodology  used  because  it  did  not  consider  the  unique  nature  of  the  EMD 
testing  and  the  EMD  test  aircraft.  On  July  12,  2002,  the  Navy  provided  the  supporting 
data  for  the  risk  assessment,  which  was  less  than  adequate.  To  have  been  a  meaningful 
risk  assessment,  the  methodology  should  have  been  revised  to  include  a  crash  frequency 
probability  based  on  the  past  performance  of  either  the  V-22  EMD  test  or  other 
developmental  aircraft.  Further,  the  system  safety  risk  assessment  model  should  have 
been  adjusted  to  account  for  the  nonindependence  between  the  “probability  that  the  crash 
occurs  over  land”  and  the  “probability  that  a  crash  is  survivable.”  Using  the  crash 
frequency  probability  data  that  the  Navy  did  provide  and  adjusting  for  the  revised 
methodology,  the  safety  risk  assessment  code  would  increase  from  undesirable  or  a 
medium  safety  risk  to  unacceptable  or  high  safety  risk.  (See  the  Finding  section  of  the 
report  for  the  detailed  recommendations.) 

Management  Comments.  In  response  to  the  draft  report,  the  Under  Secretary  stated  that 
he  has  again  concluded  that  the  benefits  of  continuing  to  fly  to  address  his  other  technical 
concerns  outweighed  the  limited  risk  reduction  attained  by  stopping  the  V-22  flight  test 
program  and  retrofitting  fuel  cells  with  greater  crashworthiness  on  the  four  EMD-only 
aircraft.  The  Under  Secretary  agreed  that  the  Military  Departments  should  use  relevant 
methodology  in  their  risk  assessment  procedures,  including  calculations  of  risk  probability, 
and  that  risk  assessments  should  be  fully  supported  and  documented.  The  Under  Secretary 
stated  that  his  office  will  ensure  that  the  Military  Departments’  safety  organizations  review 
their  procedures  and  update  them,  as  appropriate.  (See  the  Finding  section  of  this  report 
for  a  discussion  of  the  management  comments  and  the  Management  Comments  section  of 
the  report  for  the  complete  text  of  the  comments.) 
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V-22  Osprey  Joint  Advanced  Vertical  Aircraft 


Background 


Allegation.  The  Office  of  the  Inspector  General  of  the  Department  of  Defense 
received  multiple  allegations  concerning  the  viability  of  the  V-22  Osprey  Joint 
Advanced  Vertical  Aircraft  (the  V-22).  This  audit  resulted  from  allegations 
referred  to  us  by  the  Commandant  of  the  Marine  Corps  on  December  27,  2001. 
The  audit  addressed  four  allegations  concerning  the  crashworthiness  of  the  fuel 
cells  or  tanks  installed  on  the  V-22.  The  Office  of  the  Inspector  General  of  the 
Department  of  Defense  will  address  the  other  allegations  in  a  separate  report. 

See  Appendix  B  for  further  details  regarding  the  four  allegations. 

V-22  Aircraft.  The  V-22,  a  Navy  Acquisition  Category  ID  program,  is  a 
tilt-rotor,  vertical  take-off  and  landing  aircraft,  which  operates  as  a  helicopter 
for  takeoffs  and  landings  and,  once  airborne,  converts  to  a  turboprop  aircraft. 
The  V-22  is  expected  to  operate  in  global  and  regional  conflicts  in  support  of 
operations  ranging  from  peacetime  engagements  to  conventional,  high-intensity, 
general  warfare.  The  V-22  has  three  variants:  the  Marine  Corps  variant  to 
meet  amphibious  and  vertical  assault  needs,  the  Navy  variant  to  be  used  for 
rescue  needs,  and  the  Air  Force  variant  for  special  operations  missions.  The 
V-22  Osprey  will  replace  the  Marine  Corps  CH-46E  Sea  Knight  and  the 
CH-53D  Sea  Stallion.  Appendix  C  provides  additional  definitions  of  technical 
terms  used  in  this  report. 

The  V-22  Program  started  in  December  1981  and  was  originally  managed  by  the 
Army  until  it  was  transferred  to  the  Navy  in  1982.  The  Under  Secretary  of 
Defense  for  Acquisition,  Technology,  and  Logistics  (USD[AT&L])  approved 
the  entry  of  the  V-22  into  low-rate  initial  production  (LRIP)  in  April  1997,  and 
delegated  future  V-22  production  decisions  to  the  Navy.  However,  in  May 
2001,  the  USD(AT&L)  designated  the  V-22  as  an  Acquisition  Category  ID 
program,  thereby  rescinding  the  previous  delegation.  The  V-22  Program 
Manager  manages  the  V-22  acquisition  program  under  the  Program  Executive 
Office,  Air  Anti-Submarine  Warfare,  Assault,  and  Special  Mission  Programs. 
Bell  Boeing,  a  joint  venture  of  Bell  Helicopters  Textron  and  the  Boeing 
Company,  teamed  up  to  develop  and  produce  the  V-22. 

Since  the  V-22  Program  began  in  1981,  it  has  lost  four  aircraft.  In  June  1991,  a 
full-scale  development  (FSD)  V-22  aircraft  experienced  a  vertical  takeoff 
accident  due  to  improper  installation  of  sensors  in  the  flight  control  system.  In 
July  1992,  a  second  FSD  aircraft  encountered  a  fatal  accident  because  of  drive 
shaft  and  engine  failure  resulting  from  compressor  stall  and  fire.  In  April  2000, 
an  LRIP  aircraft  experienced  an  excessive  rate  of  descent  and  the  effects  of  a 
vortex  ring  state  that  resulted  in  an  asymmetrical  loss  of  lift  accompanied  by  a 
roll  at  too  low  an  altitude  to  recover  before  ground  impact.  In  December  2000, 
another  LRIP  aircraft  crashed  resulting  from  the  loss  of  a  hydraulic  line 
combined  with  a  flight  control  software  malfunction.  As  a  result  of  the  mishaps 
and  operational  suitability  issues  identified  in  testing,  the  Secretary  of  Defense 
established  an  independent  review  of  the  V-22  Program  by  a  group  known  as 
“The  Blue  Ribbon  Panel.”  The  Blue  Ribbon  Panel  found  no  evidence  of 
inherent  safety  flaws  in  the  V-22  tilt-rotor  concept  and  recommended  that  the 
program  be  continued,  but  restructured.  The  Blue  Ribbon  Panel  determined  that 
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the  V-22  aircraft  lacked  the  maturity  needed  for  full-rate  production  or 
operational  use  and  made  recommendations  for  corrective  action.  Based  on  the 
Blue  Ribbon  Panel’s  recommendations,  the  USD(AT&L)  restructured  the 
V-22  Program  and  required  extensive  additional  flight  testing. 

The  Navy  and  the  Air  Force  plan  to  acquire  397  and  40  aircraft,  respectively,  at 
an  estimated  cost  of  $37.2  billion  from  FY  1982  through  FY  2015.  As  of 
March  2002,  the  Navy  had  acquired  or  contracted  for  40  V-22  aircraft 
consisting  of  FSD,  engineering  and  manufacturing  development  (EMD),  and 
LRIP  aircraft,  as  shown  in  the  following  table  and  Appendix  D.1 


V-22  Aircraft  Under  Contract  or  Delivered 

Aircraft 

Acquisition 

Under 

Aircraft 

Phase 

Contract 

Delivered 

FSD 

6 

52 

EMD 

4 

4 

LRIP  Lot  1 

5 

53 

LRIP  Lot  2 

7 

54 

LRIP  Lot  3 

7 

0 

LRIP  Lot  4 

n 

_0 

Total 

40 

19 

On  May  29,  2002,  the  Navy  restarted  EMD  flight  testing  of  the  V-22  aircraft. 

As  of  October  2002,  the  program  was  in  LRIP;  however,  USD(AT&L)  has  not 
determined  a  date  for  the  full-rate  production  decision. 

V-22  Fuel  Cells.  The  V-22  fuel  cell  is  a  flexible  bladder  that  is  shaped  to  fit  the 
designated  cavity  in  the  V-22  aircraft  and  is  designed  to  hold  aircraft  fuel.  All 
fuel  cells  are  to  be  self-sealing  when  penetrated  by  a  12.7  millimeter  or 
.50  caliber  armor-piercing  projectile  and  meet  a  drop  test  requirement  of  65  feet 
when  filled  with  water. 

The  three  V-22  variants  have  different  fuel  cell  configurations.  The  Navy  and 
Marine  Corps  variants  have  five  fuel  cells  integrated  into  the  wings  and  fuselage 
sponson:5  two  wing  feed  cells,  two  forward  sponson  cells,  and  a  right  aft 
sponson  cell.  The  Air  Force  variant  has  four  additional  cells  in  each  wing. 


'Subsequent  to  the  completion  of  our  audit  fieldwork,  the  Navy  notified  us  that  it  had  contracted  for 
20  LRIP  aircraft  for  Lots  5  and  6.  Our  review  included  only  those  LRIP  aircraft  from  Lots  1  through  4. 
2Two  of  those  aircraft  crashed,  one  was  used  for  live-fire  testing,  and  two  are  display  aircraft.  One  of 
the  aircraft  under  contract  was  never  built. 

3One  of  those  aircraft  crashed. 

4One  of  those  aircraft  crashed. 

5A  sponson  is  a  projection  from  the  side  of  the  aircraft  that  holds  the  fuel  cells  and  landing  gear. 
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Each  variant  can  carry  additional  auxiliary  cells  in  the  cabin  for  self-deployment 
missions.  The  following  figure  shows  the  fuel  cell  configurations. 


Forward  sponson  fuel  cells 


Wing  feed  fuel  cells 


Wing  auxiliary 


Cabin  auxiliary 
fuel  cells 


Right  aft  sponson 
fuel  cell 


V-22  Fuel  Cell  Configuration 

Source:  Naval  Air  Systems  Command  V-22  Website 


Objectives 


The  primary  audit  objective  was  to  review  the  documentation  associated  with 
developing,  contracting,  testing,  and  installing  the  fuel  cells  on  the  V-22  and  the 
future  funding  for  fuel  cell  improvements.  See  Appendix  A  for  a  discussion  of 
the  audit  scope  and  methodology,  and  prior  coverage  related  to  the  audit 
objectives. 
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V-22  Fuel  Cell  Crashworthiness  and 
Ballistic  Requirements 

Safety  risks  for  V-22  flight  testing  were  not  minimized  because  V-22 
aircraft  in  use  for  EMD  flight  testing  have  noncrashworthy  fuel  cells. 

The  V-22  fuel  cells  in  the  fuselage  sponsons  for  the  4  EMD  aircraft,  the 
aft  fuel  cell  in  the  right  fuselage  sponson  for  the  12  LRIP  aircraft  in 
Lots  1  and  2,  and  all  fuel  cells  in  the  fuselage  sponsons  for  the  7  LRIP 
aircraft  in  Lot  3  did  not  meet  crashworthiness  standards.  Further,  the 
V-22  fuel  cells  in  the  EMD  aircraft  and  in  the  LRIP  aircraft  for  Lots  1, 

2,  and  3  did  not  meet  ballistic  live-fire  requirements.  The  Navy  did  not 
plan  to  remedy  those  conditions  for  the  EMD  test  aircraft  because  they 
would  be  used  only  for  flight  testing.  The  V-22  Program  Office  issued  a 
waiver  for  the  LRIP  aircraft  to  allow  noncompliant  fuel  cells  to  be 
installed  so  that  aircraft  production  would  not  be  delayed.  For 
subsequent  lots,  the  contractor  developed  sponson  fuel  cells  that  meet 
crashworthiness  and  ballistic  requirements.  The  V-22  Program  Office 
plans  to  install  those  compliant  fuel  cells  at  an  average  cost  to  the 
Government  of  about  $512,000  per  aircraft  on  the  17  remaining  LRIP 
aircraft  from  Lots  1  through  3,  but  does  not  plan  to  install  crashworthy 
sponson  fuel  cells  on  the  V-22  aircraft  used  for  EMD  testing  because: 

•  a  formal  safety  risk  assessment  evaluated  the  fuel  cell 
configuration  to  be  a  medium  risk  and 

•  the  benefits  of  returning  to  flight  outweighed  the  limited  risk 
reduction  attained  by  retrofitting  the  aircraft  with  crashworthy 
fuel  cells. 

However,  the  formal  safety  risk  assessment  was  not  supported  by 
documentation  before  flight  testing  resumed  and  the  methodology  used 
was  flawed.  As  a  result,  the  safety  risk  assessment  cannot  be  relied  upon 
and  the  safety  risk  to  aircrews  of  those  EMD  test  aircraft  will  not  be 
minimized  if  the  aircraft  are  not  retrofitted  before  further  use  in  flight 
testing. 


V-22  Fuel  Cell  Specifications 


The  following  provides  an  overview  of  the  military  specifications  associated 
with  the  V-22  fuel  cells. 

Navy  Specification.  Naval  Air  Systems  Command  specification  document, 

SD  572-1,  Revision  C,  “Detailed  Specification  for  V-22  Engineering  and 
Manufacturing  Development,”  September  13,  1995,  establishes  the  qualification 
requirements  for  the  V-22  to  enable  the  Army,  Navy,  Air  Force,  and  Marine 
Corps  to  conduct  combat  missions  requiring  vertical  and  short-field  takeoffs  and 
landings.  The  specification  states  that  the  fuel  cells  will  be  manufactured  in 
accordance  with  the  contractor’s  specification  that  defines  two  types  of  fuel  cell 
construction:  nonextensible  (high-strength  fabric)  and  extensible  (flexible 
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rubber).  The  sponson  fuel  cells  will  be  self-sealing  for  the  lower  third  and 
inboard  wall  of  the  cell.  The  contractor  will  establish  the  effects  that  weight  and 
cost  have  on  the  aircraft  to  determine  damage  tolerance.  When  damage 
tolerance  requirements  cannot  be  met  because  of  stringent  contract  weight,  cost, 
or  other  penalties,  the  contractor  is  to  identify  such  affected  areas  and  propose 
deviations  or  waivers  of  specific  requirements,  subject  to  Naval  Air  Systems 
Command  approval. 

Further,  the  specification  states  that  aircraft  crashworthiness  should  meet  the 
requirements  of  Military  Standard  1290,  “Light  Fixed  and  Rotary  Wing  Aircraft 
Crashworthiness,”  July  21,  1977,  to  the  maximum  extent  practical. 

Appendix  A,  “Test  Methods,”  of  the  Standard  states  that  fuel  cells  will  be  tested 
in  accordance  with  DoD  Military  Specification  MIL-T-27422B,  “Tank,  Fuel, 
Crash-Resistant,  Aircraft,”  February  24,  1970. 

Military  Specification.  DoD  Military  Specification  MIL-T-27422B  allows  for 
crashworthy  fuel  cells  that  will  be  either  self-sealing  or  non-self-sealing.  A 
crashworthy  and  self-sealing  fuel  cell  is  designed  to  withstand  a  65-foot  drop 
without  leaking  and  seal  itself  if  a  projectile  penetrates  the  cell  wall.  Any 
rupture  from  the  drop  that  results  in  spillage  constitutes  failure.  Further,  all 
gunfire  wounds  associated  with  ballistic  live-fire  testing  must  self-seal  within  a 
specified  timeframe  after  being  penetrated  by  an  armor-piercing  projectile  up  to 
12.7  millimeters  or  .50  caliber. 


V-22  Fuel  Cell  Compliance 


The  V-22  fuel  cells  in  the  fuselage  sponsons  for  the  EMD  aircraft,  the  aft  fuel 
cell  in  the  right  fuselage  sponson  for  the  LRIP  aircraft  in  Lots  1  and  2,  and  all 
of  the  fuel  cells  in  the  fuselage  sponsons  for  the  LRIP  aircraft  in  Lot  3  did  not 
meet  crashworthiness  standards.  Further,  the  V-22  fuel  cells  in  the  EMD 
aircraft  and  in  the  LRIP  aircraft  in  Lots  1,2,  and  3  did  not  meet  ballistic 
requirements. 

V-22  Fuel  Cell  Development.  The  contract  specifications  for  the  V-22  aircraft 
allow  the  use  of  extensible  or  nonextensible  fuel  cells.  To  obtain  a  significant 
aircraft  weight  savings,  Boeing  and  the  Navy  decided  to  use  the  extensible  fuel 
cell  construction  in  the  fuselage  sponson  fuel  cells  of  the  V-22  aircraft,  rather 
than  the  nonextensible  fuel  cell  construction  traditionally  used  in  Navy 
helicopters.  Boeing  initially  pursued  using  an  extensible  fuel  cell  developed  by 
Fire  Proof  Tanks,  a  European  company.  However,  because  of  the  “Buy 
American”  restriction  of  the  Berry  Amendment,6  Boeing  did  not  use  the 
European  company  to  produce  the  extensible  fuel  cells.  Consequently,  Fire 
Proof  Tanks  licensed  International  Latex  Company  to  produce  the  extensible 


6The  Berry  Amendment,  which  Congress  has  included  in  various  forms  in  DoD  appropriations  acts  every 
year  since  1941  and  which  the  National  Defense  Authorization  Act  for  FY  2002  codified,  generally 
restricts  DoD  expenditure  of  funds  for  certain  articles  and  items  to  American  goods.  The  DoD 
Appropriations  Act  for  FY  1968  added  synthetic  fabric  and  coated  synthetic  fabric  to  the  Berry 
Amendent’s  list  of  protected  articles.  Fuel  cells  contain  synthetic  fabric. 
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fuel  cells  in  the  United  States.  Under  this  licensing  agreement.  International 
Latex  Company  manufactured  the  fuel  cells  installed  on  the  21  aircraft  for  FSD 
through  LRIP,  Lot  2.  Specifically,  Boeing  used  extensible  fuel  cells  in  the 
5  FSD  aircraft,7  the  4  EMD  aircraft,  and  the  12  LRIP  aircraft  for  Lots  1  and  2. 
For  the  7  LRIP  aircraft  in  Lot  3  and  the  1 1  LRIP  aircraft  in  Lot  4,  Boeing  used 
nonextensible  fuel  cells  manufactured  by  American  Fuel  Cell  and  Coated 
Fabrics  Company,  and  Engineered  Fabrics  Corporation,  respectively. 

Appendix  D  lists  the  V-22  aircraft  acquired  from  FSD  through  LRIP,  Lot  4,  and 
provides  the  results  of  testing  performed  on  the  fuel  cells  in  those  aircraft. 

Crashworthiness  and  Ballistic  Testing.  The  4  EMD  aircraft  and  the  19  LRIP 
aircraft  in  Lots  1,2,  and  38  had  wing  fuel  cells  and  breakaway  valves  that  met 
crashworthiness  and  ballistic  specifications.  However,  the  fuel  cells  in  the 
sponsons  for  the  4  EMD  aircraft,  the  aft  fuel  cell  in  the  right  sponson  in  the 
12  LRIP  aircraft  in  Lots  1  and  2,  and  all  fuel  cells  in  the  sponsons  for  the 
7  LRIP  aircraft  in  Lot  3  did  not  meet  crashworthiness  specifications.  Further, 
the  forward  and  aft  fuselage  sponson  fuel  cells  in  the  EMD  aircraft  and  the 
LRIP  aircraft  in  Lots  1,2,  and  3  did  not  meet  ballistic  specifications.  However, 
the  sponson  fuel  cells  for  the  LRIP  aircraft  in  Lot  4  did  meet  crashworthiness 
and  ballistic  specifications. 

Testing  for  Lots  1  and  2  Extensible  Fuel  Cells.  The  forward 
extensible  fuel  cells  in  the  fuselage  sponson  used  in  the  LRIP  aircraft  for  Lots  1 
and  2  passed  the  65-foot  drop  test.  However,  the  aft  extensible  fuel  cell  in  the 
right  fuselage  sponson  used  in  the  Lots  1  and  2  aircraft  experienced  a  1.5  ounce 
per  minute  leak  at  the  fittings  after  the  65-foot  drop  test.  Further,  none  of  the 
fuels  cells  in  the  Lots  1  and  2  aircraft  passed  the  ballistic  tests.  Consequently, 
the  contractor  requested  a  waiver  of  the  crashworthiness  and  ballistic 
qualification  requirements  for  Lots  1,2,  and  3  aircraft  for  specific  fuel  cell  part 
numbers.  Even  though  the  aft  extensible  fuel  cell  and  all  fuel  cells  in  Lots  1  and 
2  did  not  pass  the  drop  test  and  the  ballistic  test,  respectively,  the  V-22  Program 
Manager  concluded  that  the  fuel  cells  were  acceptable  for  flight  and  approved 
the  waiver,  thereby  accepting  noncompliant  fuel  cells.  Appendix  E  provides  a 
copy  of  the  waiver. 

Although  the  extensible  fuel  cells  were  not  a  contributing  factor  to  the  April 
2000  crash,  the  immediate  post-crash  fire  generated  interest  in  the  issue  of 
survivability  as  it  related  to  the  sponson  fuel  cells  installed  in  the  V-22.  The 
Marine  Corps  concluded  in  its  July  21,  2000,  memorandum  (commonly  know  as 
“JAGMAN  Report”),  “Investigation  Into  the  Circumstances  Surrounding  the 
Class  “A”  Aircraft  Mishap  Involving  an  MV-22B  Osprey  Buno  165436  That 
Occurred  on  8  April  2000  at  Marana  Northwest  Regional  Airport  Near  Tucson 
Arizona,  ”  that  the  excessive  forces  resulting  from  gravitational  acceleration 
encountered  in  the  crash  far  exceeded  the  survivability  requirements  of  the 
aircraft  fuel  system. 


7The  Navy  planned  to  acquire  six  FSD  aircraft;  however,  one  was  never  built. 

8Since  the  crashes,  only  17  of  those  19  LRIP  aircraft  remain. 


6 


Testing  for  Lot  3  Nonextensible  Fuel  Cells.  For  LRIP  aircraft  in 
Lot  3,  Boeing  subcontracted  with  a  different  contractor,  American  Fuel  Cell  and 
Coated  Fabrics  Company,  for  nonextensible  cells  in  the  sponson  because  the 
extensible  cells  used  in  Lots  1  and  2  experienced  cost  escalation  and 
qualification  difficulties.  Consequently,  the  waiver  for  the  Lot  3  aircraft  no 
longer  applied  because  the  Lot  3  nonextensible  fuel  cells  manufactured  by 
American  Fuel  Cell  and  Coated  Fabrics  Company  had  different  part  numbers 
from  the  extensible  fuel  cells  produced  by  International  Latex  Company  for 
which  the  waiver  applied.  Furthermore,  developmental  testing  indicated  that  the 
nonextensible  cells  manufactured  by  American  Fuel  Cell  and  Coated  Fabrics 
Company  did  not  pass  the  65-foot  drop  and  ballistic  tests.  Consequently, 

Boeing  submitted  a  request  for  waiver  of  the  crashworthiness  and  ballistic 
qualification  requirements  for  Lot  3  fuel  cells  because  the  previous  waiver 
applied  to  different  fuel  cell  part  numbers.  The  Navy  did  not  approve  the 
waiver.  However,  even  though  the  Lot  3  nonextensible  fuel  cells  manufactured 
by  American  Fuel  Cell  and  Coated  Fabrics  Company  did  not  pass  the  65-foot 
drop  and  ballistic  tests,  the  Navy  considered  the  nonextensible  fuel  cells  more 
crashworthy  and  ballistically  acceptable  than  the  extensible  fuel  cells  used  in 
Lots  1  and  2.  Subsequently,  the  Navy  accepted  the  Lot  3  nonextensible  fuel 
cells  because  those  fuel  cells  met  the  penetration  and  tear  requirements  of  the 
Military  Specification  MIL-T-27422B. 

Testing  for  Lot  4  Nonextensible  Fuel  Cells.  Because  the  Lot  3  sponson 
fuel  cells  that  American  Fuel  Cell  and  Coated  Fabrics  Company  produced  did 
not  pass  the  drop  and  ballistic  tests,  Boeing  contracted  with  Engineered  Fabrics 
Corporation  to  design  a  nonextensible  fuel  cell  that  would  withstand  the  65-foot 
drop  and  ballistic  tests  for  Lot  4.  During  testing  in  2001,  Boeing  determined 
that  the  Lot  4  fuel  cells  complied  with  the  crashworthiness  and  ballistic 
requirements  in  SD  572-1,  Military  Standard  1290,  and  Military  Specification 
MIL-T-27422B.  Consequently,  Boeing  plans  to  install  nonextensible  fuel  cells 
manufactured  by  Engineered  Fabrics  Corporation  in  the  sponson  for  the  LRIP 
aircraft  in  Lot  4  and  subsequent  production  aircraft. 

Rework,  Retrofit,  Safety  Risk,  Resumption  of  Flight  Test,  Navy  Evaluation 
Methodology,  and  Navy  Support  for  Risk  Assessment.  The  Navy  plans  to 
have  Boeing  retrofit  or  rework  V-22  sponson  fuel  cells  in  Lots  1,2,  and  3  with 
the  compliant  nonextensible  fuel  cells  manufactured  by  Engineered  Fabrics 
Corporation. 

Rework.  Boeing  was  negotiating  with  the  Navy  for  an  engineering 
change  proposal  to  rework  the  sponson  fuel  cells  used  in  Lot  3  aircraft  because 
those  aircraft  contain  nonextensible  fuel  cells  that: 

•  do  not  comply  with  military  specifications, 

•  do  not  have  an  approved  waiver  for  noncompliant  fuel  cells, 
and 

•  are  installed  on  aircraft  that  have  not  been  delivered  to  the 
Navy. 


7 


As  of  October  2002,  the  Navy  had  not  approved  Boeing’s  engineering  change 
proposal  even  though  it  plans  to  have  Boeing  rework  the  sponson  fuel  cells  used 
in  Lot  3  aircraft  and  replace  those  fuel  cells  with  compliant  nonextensible  fuel 
cells.  Further,  Boeing  will  install  compliant  nonextensible  fuel  cells  in  aircraft 
produced  after  Lot  3. 

Retrofit.  Although  the  Navy  approved  a  waiver  for  crashworthiness 
and  ballistic  requirements  for  the  LRIP  aircraft  in  Lots  1  and  2,  the  Fuel 
Containment  Branch  at  the  Naval  Air  Systems  Command  and  Boeing 
recommended  to  the  V-22  Program  Office  that  the  EMD  and  Lots  1  and  2 
aircraft  be  retrofitted  with  compliant  nonextensible  fuel  cells,  when  they  became 
available.  Boeing  also  recommended  that  the  aircraft  be  retrofitted  with  a  larger 
access  hole  for  fuel  cell  installation.  In  response,  the  Navy  approved  an 
engineering  change  proposal  submitted  by  Boeing  for  retrofitting  the  sponson 
fuel  cells  in  Lots  1  and  2  with  compliant  fuel  cells.  However,  the  Navy  did  not 
approve  retrofitting  the  EMD  aircraft  because  those  aircraft  would  be  used  only 
for  flight  testing.  Consequently,  on  March  15,  2002,  the  Deputy  Inspector 
General  requested  that  the  USD(AT&L)  determine  whether  the  risk  of  flying  the 
EMD  aircraft  with  noncrashworthy  fuel  cells  was  acceptable  (Appendix  F). 

On  March  28,  2002,  the  Commander,  Naval  Air  Systems  Command  issued  a 
memorandum  to  the  USD(AT&L)  (Attachment  in  Appendix  G),  stating  that  the 
risk  of  conducting  the  flight  testing  of  the  EMD  test  aircraft  with  noncompliant 
sponson  fuel  cells  was  acceptable  because: 

•  the  test  aircraft  will  operate  in  a  controlled  and  structured 
developmental  test  environment, 

•  highly  trained  pilots  will  fly  the  test  aircraft, 

•  the  aircraft  will  be  heavily  instrumented  and  tracked  with  telemetry, 

•  the  test  squadron  will  provide  significant  oversight  of  the  testing  and 
conduct  a  safety  assessment  for  each  test  plan  and  every  flight,  and 

•  no  passengers  will  be  carried  on  the  aircraft. 

Further,  the  Commander  stated  that  his  command  had  conducted  a  thorough 
system  safety  assessment  of  the  V-22  as  part  of  the  V-22  Flight  Readiness 
Review  process,  which  included  the  fuel  system  and  existing  fuel  cells  on  the 
test  aircraft. 

On  April  3,  2002,  the  USD(AT&L)  issued  a  memorandum  (Appendix  G)  in 
response  to  our  request.  In  his  response,  USD(AT&L): 

•  agreed  with  the  assessment  by  the  Commander,  Naval  Air  Systems 
Command  that  the  risk  of  conducting  developmental  testing  with 
noncrashworthy  fuel  cells  was  within  manageable  flight  test 
boundaries,  and 
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•  supported  the  Commander’s  decision  to  return  to  developmental 
testing  with  aircraft  having  noncrashworthy  fuel  cells. 

Further,  the  USD(AT&L)  stated  that  the  benefits  of  returning  the  V-22  to  flight 
as  scheduled  to  address  his  other  technical  concerns  outweighed  the  limited  risk 
reduction  achieved  by  retrofitting  the  aircraft  with  crashworthy  fuel  cells  that 
meet  the  65-foot  drop  test. 

On  April  12,  2002,  the  V-22  Program  Office,  when  asked,  was  still  unable  to 
provide  us  with  documentation  to  support  a  system  safety  risk  assessment9  of 
compliant  and  noncompliant  V-22  fuel  cells.  Boeing  had  also  been  unable  to 
provide  documentation  to  support  the  system  safety  risk  assessment  concerning 
the  use  of  compliant  and  noncompliant  fuel  cells  on  V-22  aircraft. 

Consequently,  we  believed  that  the  decision  of  the  USD(AT&L)  merited  further 
consideration. 

On  April  16,  2002,  we  issued  a  draft  report  to  the  USD(AT&L)  recommending 
that  he  direct  the  Assistant  Secretary  of  the  Navy  (Research,  Development,  and 
Acquisition)  to  require  Boeing  to  install  sponson  fuel  cells  that  comply  with 
crashworthiness  and  ballistic  standards  in  all  existing  V-22  aircraft,  including 
the  4  EMD  aircraft  and  the  17  LRIP  aircraft  from  Lots  1  through  3,  before 
flying  those  aircraft. 

On  May  6,  2002,  the  USD(AT&L)  issued  a  memorandum  (Appendix  H)  in 
response  to  our  draft  report.  The  USD(AT&L)  stated  that: 

•  all  V-22  aircraft,  except  those  used  in  EMD  testing,  will  have 
crashworthy  and  ballistic  compliant  fuels  cells  installed  in  them,  and 

•  a  formal  risk  assessment,  documented  in  a  safety  action  record, 
evaluated  the  current  fuel  cell  configuration  in  the  aircraft  to  be  used 
in  EMD  testing  and  assessed  the  risk  as  “ID  (medium)  risk.” 

Further,  the  USD(AT&L)  again  concluded  that  the  benefits  of  returning  to  flight 
as  scheduled,  to  address  other  technical  concerns,  outweighed  the  limited  risk 
reduction  attained  by  retrofitting  the  aircraft  with  crashworthy  fuel  cells. 
However,  the  safety  action  record  that  the  USD(AT&L)  cited  did  not  document 
and  support  the  basis  for  assessing  the  safety  risk  as  “ID  (medium)  risk” 
(undesirable  risk)  rather  than  “high  risk”  (unacceptable  risk),  the  next  higher 
level  of  safety  risk.  Consequently,  we  questioned  the  rigor  of  the  risk 
assessment. 

Safety  Risk.  On  May  22,  2002,  the  Inspector  General  provided  the 
USD(AT&L)  with  a  draft  information  memorandum  addressed  to  the  Deputy 
Secretary  of  Defense.  The  draft  memorandum: 

•  expressed  concerns  about  flying  EMD  test  aircraft  with 
noncrashworthy  fuel  cells,  and 


9The  system  safety  risk  assessment  assigns  a  risk  level  to  a  specific  hazard,  in  this  case  the  fuel  cells,  in 
terms  of  frequency  of  occurrence  and  severity  related  to  injury,  property  damage,  or  effect  on  mission. 
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•  recommended  that  the  USD(AT&L)  direct  the  Navy  to  only 
use  aircraft  with  crashworthy  fuel  cells  in  flight  testing  or  to 
conduct  a  formal  system  safety  risk  assessment  to  justify  and 
document  that  the  risk  is  only  “medium.  ” 

At  the  time  of  our  draft  memorandum,  the  Navy  had  not  restarted  its  EMD 
flight  testing  of  the  V-22  aircraft. 

On  May  28,  2002,  the  USD(AT&L)  issued  a  memorandum  (Appendix  I)  in 
response  to  our  draft  information  memorandum.  The  USD(AT&L)  stated  that 
the  Navy: 

•  specifically  addressed  the  fuel  cell  issue  at  a  Flight  Readiness  Review 
on  March  21,  2002,  and 

•  assessed  the  marginal  increased  risk  of  using  the  existing  fuel  cells  on 
EMD  aircraft  as  medium  risk  compared  to  the  fully  compliant  fuel 
cells  that  passed  the  65-foot  drop  test. 

Further,  the  USD(AT&L)  stated  that,  subsequent  to  his  April  3  and  May  6, 

2002,  responses,  the  Navy  formally  documented  its  risk  assessment  process.  He 
stated  that  this  formal  risk  assessment  should  satisfy  the  recommendation  in  the 
draft  information  memorandum  to  document  and  provide  increased  rigor  to  the 
Navy’s  assessment. 

On  May  28,  2002,  we  received  the  Navy’s  formal  system  safety  risk  assessment 
of  the  EMD  V-22  noncompliant  sponson  fuel  cells  (Appendix  J);  however,  the 
Navy  did  not  have  documentation  to  support  its  risk  assessment.  After  a 
preliminary  review  of  the  safety  risk  assessment,  we  contacted  the  V-22 
Program  Office  on  May  28,  2002,  to  express  our  concerns  about  the  relevancy 
of  the  methodology  used  in  the  risk  assessment  and  to  request  documentation 
that  supported  the  assumptions  made  in  the  risk  assessment.  The  V-22  Program 
Office  requested  that  we  prepare  an  e-mail  addressing  our  concerns  and  related 
questions,  including  our  request  for  supporting  documentation. 

On  May  29,  2002,  we  analyzed  the  Navy’s  formal  system  safety  risk  assessment 
and  identified  three  areas  of  concern,  as  discussed  in  Appendix  K.  Those  areas 
of  concern  included  the  probability  of  a  crash,  qualitative  considerations,  and 
data  independence  and  variability. 

Probability  of  a  Crash.  The  system  safety  risk  assessment  did 
not  base  its  crash  frequency  probability  on  past  performance  of  the  V-22  aircraft 
or  other  EMD  aircraft.  Specifically,  the  assessment’s  crash  frequency 
probability  of  2  to  10  mishaps  every  100,000  flight  hours  was  inconsistent  with 
the  number  of  mishaps  experienced  and  the  technical  challenges  of  the  V-22. 
According  to  the  V-22  Program  Office,  the  V-22  has  experienced  4  major 
mishaps  to  date  in  approximately  5,000  flight  hours.  Further,  the  estimate  of 
2  to  3  mishaps  in  100,000  flight  hours  was  based  on  historic  Class  A  helicopter 
mishap  rates  for  the  Navy  and  Marine  Corps.  However,  the  risk  assessment 
codes  are  based  on  the  risk  of  aircraft  and  property  damage  and  personal  injury. 
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not  just  on  “Class  A”  accidents  in  which  a  death  or  serious  injury  occurred.  In 
addition,  the  Program  Office  used  only  baseline  probability  data  for  helicopters 
in  its  methodology  and  not  baseline  probability  data  that  considered  airplanes  as 
well.  To  be  meaningful,  the  methodology  for  the  system  safety  risk  assessment 
should  have  been  revised  to  include  a  crash  frequency  probability  based  on  the 
past  performance  of  either  the  V-22  EMD  test  or  other  developmental 
fixed-wing  or  rotary  aircraft. 

Qualitative  Considerations.  The  Navy  did  not  plan  to 
rigorously  test  the  V-22  EMD  test  aircraft  as  part  of  the  V-22  flight  test 
program.  The  system  safety  risk  assessment  stated  that: 

•  EMD  testing  will  be  conservative, 

•  EMD  aircraft  will  have  limited  exposure  compared  to  fleet 
aircraft,  and 

•  EMD  aircraft  will  not  be  transitioned  to  fleet  use. 

Because  EMD  testing  is  used  to  demonstrate  system  capabilities,  and  V-22  EMD 
test  aircraft  will  be  used  throughout  EMD  testing,  low-risk  testing  may  be 
incompatible  with  making  an  adequate  determination  of  the  aerodynamic 
characteristics  and  operational  limitations  of  the  V-22.  Further,  in  December 
2000,  the  Defense  Science  Board  criticized  the  V-22  Program  for  severely 
reducing  the  scope  of  developmental  testing. 

Data  Independence  and  Variability.  The  independence  and 
variability  of  probability  factors  used  in  the  formula  for  the  system  safety  risk 
assessment  were  questionable.  The  Navy  should  have  considered  dependencies 
among  factors  in  making  the  safety  risk  level  determination.  For  example,  the 
“probability  that  a  crash  is  survivable”  and  “probability  that  the  crash  occurs 
over  land,”  which  the  Navy  showed  as  independent  factors,  are  dependent 
factors.  The  factors  are  dependent  because  the  probability  of  survivability  is 
related  to  the  environment  in  which  a  crash  occurs.  By  presenting  two 
dependent  factors  as  independent  factors,  the  Navy  understated  the  numeric 
value  of  the  safety  risk  assessment.  Further,  the  assessment  did  not  adequately 
address  the  variability  of  factors.  The  calculations  in  the  system  safety  risk 
assessment  addressed  the  variability  in  the  number  of  crashes.  However,  the 
variability  of  other  factors  used  in  the  Navy’s  methodology,  such  as  the 
“probability  that  the  fuel  tank  is  compromised  during  a  crash  condition,”  was 
not  addressed  in  the  risk  assessment. 

Resumption  of  Flight  Test.  On  May  29,  2002,  the  Navy  resumed  its 
flight  testing  of  the  V-22  EMD  test  aircraft,  which  had  been  grounded  since 
December  2000. 

Navy  Evaluation  Methodology.  On  June  7,  2002,  the  Inspector 
General  issued  a  memorandum  (Appendix  L)  to  USD(AT&L)  in  response  to  his 
May  28,  2002,  memorandum.  The  memorandum  stated  that  the  system  safety 
risk  assessment  raised  a  fundamental  question  concerning  the  evaluation 
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methodology  used  because  it  appears  that  the  unique  nature  of  the  EMD  testing 
and  the  EMD  test  aircraft  were  not  considered.  At  least  one  key  factor  seemed 
to  be  based  on  data  from  operational  aircraft  rather  than  EMD  aircraft,  which 
appeared  to  be  a  significant  methodological  error. 

Also  on  June  7,  2002,  we  sent  the  V-22  Program  Office  an  e-mail  in  which  we: 

•  expressed  our  concerns  about  the  support  for  the  methodology  used 
by  the  Navy  in  assessing  safety  risks  for  the  V-22  EMD  test  aircraft; 

•  submitted  questions  concerning  the  USD(AT&L)  flight  decision 
documents,  system  safety  risk  assessment  supporting  documentation 
and  methodology,  and  the  V-22  EMD  test  program;  and 

•  requested  that  the  response  be  provided  by  June  14,  2002. 

Navy  Support  for  Risk  Assessment.  On  July  12,  2002,  the  Navy 
provided  a  response  (Appendix  M)  to  our  e-mail  to  support  its  system  safety  risk 
assessment.  Our  analysis  of  the  Navy  response  is  in  Appendix  N.  Based  on  the 
data  that  the  Navy  submitted  on  July  12,  2002,  to  support  the  May  24,  2002, 
System  Safety  Risk  Assessment,  we  again  concluded  that  the  methodology  used 
to  make  the  assessment  was  flawed.  To  have  been  a  meaningful  risk 
assessment,  the  methodology  should  have  been  revised  to  include  a  crash 
frequency  probability  based  on  past  performance  of  either  the  V-22  EMD  test  or 
other  developmental  aircraft.  Further,  the  system  safety  risk  assessment  model 
should  have  been  adjusted  to  account  for  the  nonindependence  between  the 
“probability  that  the  crash  occurs  over  land”  and  the  “probability  that  a  crash  is 
survivable.”  Using  the  crash  frequency  probability  data  that  the  Navy  did 
provide  and  adjusting  for  the  revised  methodology,  the  safety  risk  assessment 
code  would  increase  from  undesirable  or  a  medium  safety  risk  to  unacceptable 
or  high  safety  risk. 

Federal  Aviation  Administration  Evaluation  Methodology.  On  June  19, 

2002,  we  contacted  the  Federal  Aviation  Administration  (FA A)  to  determine  its 
criteria  and  processes  for  certifying  developmental  aircraft.  FAA 
representatives  stated  that  the  FAA  does  not  have  criteria  or  processes  for 
certifying  developmental  aircraft.  However,  it  does  have  criteria  and  processes 
for  FAA  type  certification  to  determine  aircraft  airworthiness  and  for  purposes 
of  public  use.  The  FAA  conducts  type  certification  after  an  aircraft  has 
undergone  developmental  testing.  Further,  the  FAA  representatives  stated  that 
the  FAA  does  not  regulate  aircraft  development  other  than  ensuring  that 
developmental  flights  are  conducted  in  geographic  areas  that  ensure  public 
safety.  However,  the  FAA  does  conduct  a  risk  assessment  before  releasing  its 
pilots  to  test  aircraft  submitted  for  type  certification. 

Although  the  FAA  does  not  regulate  system  configuration  during  developmental 
testing  for  commercial  aircraft,  commercial  developmental  aircraft  have  to 
meet  FAA  standards  as  closely  as  possible  to  obtain  FAA  approval  for  type 
certification.  Further,  the  FAA  representatives  stated  that  the  FAA  was  aware 
of  a  commercial  tilt-rotor  aircraft  currently  in  development,  the  Bell 
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Agusta  609,  and  that  during  developmental  testing,  some  aspects  of  the  aircraft 
design  may  not  be  compliant  with  regulations.  They  also  stated  that  the  FAA 
routinely  flies  aircraft  with  noncompliant  designs  provided  that  an  assessment 
does  not  indicate  a  safety-of-flight  issue.  Further,  they  stated  that  a 
noncrashworthy  fuel  cell  in  a  developmental  aircraft  would  not  necessarily 
preclude  the  FAA  from  participating  in  flight  evaluations. 


Conclusion 


According  to  the  V-22  Program  Office,  the  Navy  plans  to  spend  an  average  of 
about  $512,000  per  aircraft  to  retrofit  or  rework  the  sponson  fuel  cells  in  the 
17  remaining  LRIP  aircraft  from  Lots  1  through  3,  with  the  contractor  requiring 
5  to  8  weeks  to  retrofit  or  rework  each  aircraft  to  make  it  compliant.  However, 
the  V-22  Program  Office  does  not  plan  to  install  crashworthy  sponson  fuel  cells 
on  V-22  aircraft  used  in  EMD  testing.  If  the  USD(AT&L)  does  not  require  the 
Navy  to  retrofit  the  noncompliant  extensible  fuel  cells  on  the  EMD  flight  test 
aircraft,  the  crew’s  survivability  chances  under  crash  conditions  may  be 
diminished.  The  increased  risk  could  occur  because  the  survivability  of  an 
extensible  fuel  cell  is  based  on  the  cell’s  ability  to  expand  under  a  crash 
condition  and  dissipate  crash  energy  through  its  surrounding  structure. 

However,  if  the  fuel  cell  wall  cannot  stretch  to  relieve  localized  point  loads, 
such  as  if  areas  of  the  fuel  cell  are  restrained  by  the  aircraft  structure,  the  fuel 
cell  may  not  be  able  to  resist  a  puncture  or  it  may  tear,  or  both.  Further,  the 
probability  that  the  extensible  fuel  cell  may  tear  is  increased  over  that  of 
nonextensible  fuel  cells  because  the  puncture  and  tear  resistance  of  the 
extensible  fuel  cell  is  considerably  less  than  that  of  the  nonextensible  fuel  cell 
construction.  In  addition,  if  a  V-22  aircraft  with  noncrashworthy  fuel  cells 
should  experience  a  survivable  crash,  followed  by  a  post-crash  fire,  the  Navy 
would  not  have  minimized  the  safety  risk  to  the  crew. 

Further,  the  system  safety  risk  assessment  for  the  noncompliant  sponson  fuel 
cells  on  the  V-22  EMD  test  aircraft,  which  the  USD(AT&L)  cited  in  his 
decision  to  not  retrofit  EMD  test  aircraft,  should  not  have  been  relied  upon  for 
decision  making  because  it  was  unsupported  and  the  methodology  used  was 
flawed.  Specifically,  the  safety  risk  assessment  code  would  increase  from 
undesirable  or  a  medium  safety  risk  to  unacceptable  or  high  safety  risk  if: 

•  the  crash  frequency  probability  was  based  on  the  past  performance  of 
either  the  V-22  EMD  test  aircraft  or  fixed-wing  test  aircraft,  which 
was  data  provided  by  the  Navy,10  and 

•  the  system  safety  risk  assessment  model  was  adjusted  to  account  for 
the  nonindependence  between  the  “probability  that  the  crash  occurs 
over  land”  and  the  “probability  that  a  crash  is  survivable.” 


‘“Appendix  N,  Issue  3,  Pages  53  and  54. 
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Recommendations  and  Management  Comments 


We  recommend  that  the  Under  Secretary  of  Defense  for  Acquisition, 
Technology,  and  Logistics: 

1.  Reconsider  his  decision  to  fly  the  V-22  engineering  and 
manufacturing  development  test  aircraft  without  sponson  fuel  cells  that 
comply  with  crashworthiness  standards. 

Management  Comments.  The  Under  Secretary  of  Defense  for  Acquisition, 
Technology,  and  Logistics  stated  that  he  has  again  concluded  that  the  benefits  of 
continuing  to  fly  to  address  his  other  technical  concerns  outweighed  the  limited 
risk  reduction  attained  by  stopping  the  V-22  flight  test  program  and  retrofitting 
fuel  cells  with  greater  crashworthiness  on  the  four  EMD-only  aircraft.  For  the 
complete  text  of  the  Under  Secretary’s  comments,  see  the  Management 
Comments  section  of  this  report. 

2.  Establish  procedures  to  ensure  that  system  safety  risk  assessments 
use  a  relevant  methodology  and  are  fully  supported  and  documented. 

Management  Comments.  The  Under  Secretary  of  Defense  for  Acquisition, 
Technology,  and  Logistics  agreed  that  the  Military  Departments  should  use 
relevant  methodology  in  their  risk  assessment  procedures,  including  calculations 
of  risk  probability,  and  that  risk  assessments  should  be  fully  supported  and 
documented.  Further,  the  Under  Secretary  stated  that  his  office  will  ensure  that 
the  Military  Departments’  safety  organizations  review  their  procedures  and 
update  them,  as  appropriate. 
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Appendix  A.  Scope  and  Methodology 


We  reviewed  documentation  dated  from  March  1986  to  August  2002.  To 
accomplish  the  audit  objective,  we: 

•  reviewed  developmental  test  reports  concerning  the  V-22  fuel  cells; 

•  reviewed  fuel  cell  test  reports  by  the  Commander,  Operational  Test 
and  Evaluation  Force  and  the  Director,  Operational  Test  and 
Evaluation; 

•  discussed  V-22  fuel  cell  test  and  evaluation  results  with  personnel  in 
the  Office  of  the  Director,  Operational  Test  and  Evaluation;  the  V-22 
Program  Office;  and  at  Boeing; 

•  discussed  the  V-22  development  and  production  contracts  with  the 
Defense  Contract  Management  Agency,  the  V-22  Program  Office, 
and  Boeing; 

•  discussed  V-22  funding  with  personnel  in  the  V-22  Program  Office; 
and 

•  reviewed  the  Navy’s  formal  system  safety  risk  assessment  of  the 
EMD  V-22  noncompliant  sponson  fuel  cells 

We  performed  this  audit  from  January  through  August  2002  in  accordance  with 
generally  accepted  government  auditing  standards.  We  did  not  review  the 
management  control  program  because  the  audit  was  conducted  in  response  to 
allegations  referred  to  us  by  the  Commandant  of  the  Marine  Corps;  therefore, 
the  scope  was  limited  to  the  specific  allegations. 

General  Accounting  Office  High-Risk  Area.  The  General  Accounting  Office 
has  identified  several  high-risk  areas  in  the  DoD.  This  report  provides  coverage 
of  the  DoD  weapon  systems  acquisition  high-risk  area. 

Use  of  Computer-Processed  Data.  We  did  not  rely  on  computer-processed 
data  to  perform  this  audit. 

Use  of  Technical  Assistance.  An  operations  research  analyst  and  a  mechanical 
engineer  from  the  Quantitative  Methods  Division  and  the  Technical  Assessment 
Division,  respectively,  Office  of  the  Assistant  Inspector  General  for  Auditing  of 
the  Department  of  Defense,  assisted  the  auditors  in  reviewing  fuel-cell  test 
results  and  the  system  safety  risk  assessment  for  the  V-22. 
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Prior  Coverage 


During  the  last  5  years,  the  General  Accounting  Office  (GAO)  and  the  Inspector 
General  of  the  Department  of  Defense  (IG  DoD)  have  issued  reports  that 
reference  DoD  test  waivers  and  limitations.  Unrestricted  General  Accounting 
Office  and  Inspector  General  of  the  Department  of  Defense  reports  can  be 
accessed  at  http://www.gao.gov  and  http://www.dodig.osd.mil/audit/reports, 
respectively. 

General  Accounting  Office 

GAO  Report  No.  NSIAD-98-13,  “Navy  Aviation:  V-22  Cost  and 
Capability  to  Meet  Requirements  are  yet  to  be  Determined,  ” 

October  1997 

Inspector  General  of  the  Department  of  Defense 

IG  DoD  Report  on  the  Investigation  of  the  Alleged  Deletion/Falsification 
of  Information  from  the  MV-22  Osprey  Aircraft  Official  Reports, 

August  19,  2002 

IG  DoD  Report  No.  D-2000-174,  “V-22  Osprey  Joint  Advanced  Vertical 
Aircraft,”  August  15,  2000 
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Appendix  B.  Results  of  Allegations’  Review 


Of  the  four  allegations  concerning  the  V-22  fuel  cells,  we  partially  substantiated 
three,  and  did  not  substantiate  one. 

Allegation  1:  The  fuel  cell  installed  in  the  V-22  was  not  able  to  withstand 
the  required  lOg  (gravitational  acceleration)  impact. 

Partially  Substantiated.  Although  we  were  unable  to  substantiate  the  existence 
of  a  lOg  impact  requirement  for  any  of  the  V-22  fuel  cells,  we  did  substantiate 
that  fuel  cells  in  the  sponsons  for  the  EMD  aircraft,  the  aft  fuel  cell  in  the  right 
fuselage  sponson  for  the  LRIP  aircraft  in  Lots  1  and  2,  and  all  fuel  cells  in  the 
fuselage  sponsons  for  LRIP  aircraft  in  Lot  3  did  not  pass  the  65-foot  drop  test  as 
required  by  Military  Specification  MIL-T-27422B,  “Tank,  fuel, 
Crash-Resistant,  Aircraft,”  Lebruary  24,  1970.  Subsequently,  the  contractor 
developed  a  fuel  cell  that  met  the  specification  requirements.  Consequently,  the 
Navy  plans  to  have  Boeing  retrofit  the  LRIP  aircraft  in  Lots  1  and  2  and  rework 
the  LRIP  aircraft  in  Lot  3  with  the  compliant  fuel  cell. 

Allegation  2:  A  fuel  cell  that  could  withstand  the  drop  test  was  developed; 
however,  it  was  not  installed  in  the  V-22  because  of  structural  issues. 
Specifically,  to  install  a  fuel  cell  that  would  withstand  the  drop  test,  an 
access  panel  would  have  to  be  cut,  which  would  affect  the  structural 
integrity  of  the  stub  wing.  To  compensate  for  the  access  panel,  the  aircraft 
structure  would  have  to  be  modified  thereby  increasing  the  aircraft’s 
weight. 

Unsubstantiated.  We  were  unable  to  substantiate  that  fuel  cells  meeting  the 
drop  test  were  not  installed  because  of  structural  issues  that  required  cutting  an 
access  panel.  Instead,  we  determined  that  the  Navy  plans  to  have  Boeing 
retrofit  the  LRIP,  Lots  1  and  2,  sponsons  with  nonextensible  fuel  cells,  which 
meet  the  drop  test  and  ballistic  requirements.  To  install  those  nonextensible  fuel 
cells,  Boeing  will  have  to  modify  the  sponson  access  holes  to  accept  the 
compliant  nonextensible  fuel  cells.  Because  Boeing  manufactured  the  sponsons 
for  LRIP  aircraft  in  Lot  3  to  accept  nonextensible  fuel  cells,  the  access  holes  on 
those  sponsons  do  not  require  modification  to  install  compliant  nonextensible 
fuel  cells. 

Allegation  3:  The  designs  of  the  CH-46E  Sea  Knight  and  the  CH-53D  Sea 
Stallion,  which  transport  Marines,  supplies,  and  equipment,  incorporate 
fuel  cells  that  break  away  on  impact  to  prevent  fires  and  explosions. 
However,  the  V-22  design  incorporates  fuel  cells  that  will  burst  and  flood 
the  cabin  with  fuel,  dramatically  increasing  the  likelihood  of  a  fire  or  an 
explosion,  or  both. 

Partially  Substantiated.  We  were  unable  to  substantiate  that  the  CH-46E  Sea 
Knight  and  the  CH-53D  Sea  Stallion  incorporate  fuel  cells  that  break  away  on 
impact.  However,  we  were  able  to  substantiate  that  the  V-22  design  initially 
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incorporated  a  sponson  fuel  tank  structure  and  cabin  wall  in  the  full-scale 
development  aircraft  that  could  crack  and  allow  fuel  to  enter  the  cabin  as  a 
result  of  ballistic  live-fire  impact. 

Breakaway  Fuel  Cells.  According  to  the  CH-46E  Sea  Knight  and 
CH-53D  Sea  Stallion  program  offices,  the  designs  of  those  two  helicopters  did 
not  incorporate  fuel  cells  that  break  away  on  impact.  However,  the  fuel  systems 
for  the  two  helicopters  did  incorporate  breakaway  valves,  which  break  away  and 
close  on  crash  impact.  The  V-22  fuel  system  also  includes  similar  breakaway 
valves. 


V-22  Fuel  Cell  Design.  Ballistic  live-fire  tests  of  a  flyable,  full-scale 
development  aircraft  yielded  cracking  damage  in  the  sponson  fuel  tank 
structure11  and  cabin  wall  that  was  significantly  greater  than  expected.  The 
damage  was  accompanied  by  fires  under  the  fuselage  floor  and  within  the  cargo 
and  passenger  areas  of  the  fuselage.  The  damage  resulted  from  the  impact  of  an 
armor-piercing  incendiary  projectile.  Subsequently,  the  sponson  was  redesigned 
and  retested  to  make  it  more  survivable.  The  Navy  plans  to  have  Boeing  retrofit 
LRIP  aircraft  in  Lots  1  and  2  and  rework  the  Lot  3  aircraft  with  fuel  cells  that 
meet  ballistic  test  requirements.  Further,  Boeing  will  install  the  compliant  fuel 
cells  in  the  LRIP  aircraft  in  Lot  4  and  future  aircraft. 

Allegation  4:  At  no  time  has  the  V-22  fuel  cell  passed  the  drop  test. 
Consequently,  the  V-22  fuel  cell  standards  were  lowered  to  incorporate  a 
cell  design  that  would  work  and  still  maintain  a  weight  savings. 

Partially  substantiated.  Although  we  were  unable  to  substantiate  that  the  V-22 
fuel  cells  had  never  passed  the  drop  test,  we  did  substantiate  that  the  V-22  fuel 
cells  in  the  sponsons  for  the  EMD  aircraft,  the  aft  fuel  cell  in  the  right  fuselage 
sponson  for  the  LRIP  aircraft  in  Lots  1  and  2,  and  all  fuel  cells  in  the  fuselage 
sponsons  for  the  LRIP  aircraft  in  Lot  3  did  not  withstand  the  65 -foot  drop  test. 
However,  the  V-22  forward  fuel  cells  in  the  sponson  for  the  LRIP  aircraft  in 
Lots  1  and  2  passed  the  65-foot  drop  test. 

We  were  not  able  to  substantiate  that  the  V-22  fuel  cell  standards  were  lowered 
or  made  less  stringent  to  incorporate  a  cell  design  that  would  work  and  still 
maintain  a  weight  savings.  However,  for  Lots  1,2,  and  3,  the  Navy  approved  a 
waiver  request  for  relief  from  the  drop  test  and  ballistic  specifications  for  the 
extensible  sponson  fuel  cells,  which  Boeing  originally  selected  for  the  aircraft 
because  of  their  reduced  weight.  Subsequently,  Boeing  developed  sponson  fuel 
cells  that  met  the  drop  test  requirements.  Consequently,  the  Navy  plans  to  have 
Boeing  retrofit  LRIP  aircraft  in  Lots  1  and  2  and  rework  the  Lot  3  aircraft  with 
the  compliant  fuel  cell.  Further,  Boeing  will  install  the  compliant  fuels  cells  in 
the  LRIP  aircraft  in  Lot  4  and  future  aircraft. 


nThe  fuel  cells  are  located  in  the  sponson  outside  the  cabin  walls. 
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Appendix  C.  Definitions  of  Technical  Terms 


Acquisition  Category.  An  acquisition  category  is  an  attribute  of  an  acquisition 
program  that  determines  the  program’s  level  of  review,  decision  authority,  and 
applicable  procedures.  The  acquisition  categories  consist  of  I,  major  Defense 
acquisition  programs;  IA,  major  automated  information  systems;  II,  major 
systems;  III,  programs  not  meeting  the  criteria  for  acquisition  categories  I,  IA, 
or  II;  and  IV,  programs  designated  as  such  by  the  Army,  Navy,  and  Marine 
Corps. 

Acquisition  Category  ID.  An  Acquisition  Category  ID  program  is  a  major 
Defense  acquisition  program  for  which  the  milestone  decision  authority  is  the 
Under  Secretary  of  Defense  for  Acquisition,  Technology,  and  Logistics. 

Acquisition  Program  Baseline.  An  acquisition  program  baseline  is  a  document 
that  contains  the  cost,  schedule,  and  performance  parameters  for  a  program. 

Allegation.  An  allegation  is  an  assertion,  claim,  declaration,  or  statement  that 
is  made  with  or  without  supporting  evidence  and  questions  the  existence  of  one 
or  more  facts. 

Ballistic  Live-Fire  Test.  To  meet  ballistic  live-fire  test  requirements,  the  fuel 
cells  must  be  self-sealing  when  penetrated  by  a  12.7  millimeter  or  .50  caliber 
armor-piercing  projectile. 

Class  A  Mishap.  A  Class  A  mishap  is  an  accident  in  which  a  death  or  serious 
injury  occurred. 

Crashworthy  Test.  To  meet  the  crashworthy  test  requirements,  the  fuel  cell 
must  be  able  to  withstand  a  drop  test  of  65  feet  when  filled  with  water. 

Developmental  Test  and  Evaluation.  Developmental  test  and  evaluation  is  any 
testing  used  to  assist  in  the  development  and  maturation  of  products,  product 
elements,  or  manufacturing  or  support  processes.  It  is  also  any  engineering-type 
test  used  to  verify  status  of  technical  progress,  verify  that  design  risks  are 
minimized,  substantiate  achievement  of  contract  technical  performance,  and  certify 
readiness  for  initial  operational  testing.  Development  tests  generally  require 
instrumentation  and  measurements  and  are  accomplished  by  engineers,  technicians, 
or  soldier  operator-maintainer  test  personnel  in  a  controlled  environment  to 
facilitate  failure  analysis. 

Engineering  Change  Proposal.  An  engineering  change  proposal  is  a  proposal  to 
the  responsible  authority  recommending  that  a  change  to  an  original  item  of 
equipment  be  considered,  and  the  design  or  engineering  change  be  incorporated 
into  the  article  to  modify,  add  to,  delete,  or  supersede  original  parts. 

Engineering  and  Manufacturing  Development.  The  engineering  and 
manufacturing  development  phase  of  the  acquisition  process  is  to  translate  the 
most  promising  design  approach  into  a  stable,  interoperable,  producible, 
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supportable,  and  cost-effective  design;  to  validate  the  manufacturing  process  or 
production  process;  and  to  demonstrate  system  capabilities  through  testing. 
Low-rate  initial  production  usually  occurs  toward  the  end  of  the  engineering  and 
manufacturing  development  phase. 

Extensible  Fuel  Cell.  An  extensible  fuel  cell  is  made  of  flexible  material  that 
expands  to  dissipate  crash  energy. 

Full-Rate  Production  Decision.  A  full-rate  production  decision  is  a  review 
normally  conducted  at  the  conclusion  of  low-rate  initial  production  that 
authorizes  entry  into  full-rate  production  and  deployment. 

Full-Scale  Development.  Full-scale  development  was  an  acquisition  phase, 
which  changed  to  the  engineering  and  manufacturing  development  phase  in  the 
early  1990s.  See  the  term  engineering  and  manufacturing  development  for  a 
definition  of  that  phase. 

Fuselage.  A  fuselage  is  the  central  body  portion  of  an  aircraft  designed  to 
accommodate  the  crew  and  passengers  or  cargo. 

Low-Rate  Initial  Production.  Low-rate  initial  production  establishes  an  initial 
production  base  for  the  system,  permits  an  orderly  production  rate  increase 
sufficient  to  lead  to  a  smooth  transition  to  full-rate  production,  and  provides 
production  representative  articles  for  initial  operational  test  and  evaluation  and 
live-fire  testing.  This  production  effort  concludes  with  a  full-rate  production 
decision  review  to  authorize  full-rate  production  and  deployment. 

Major  Defense  Acquisition  Program.  A  major  defense  acquisition  program  is 
a  program  that  the  Under  Secretary  of  Defense  for  Acquisition,  Technology, 
and  Logistics  estimates  will  require  an  eventual  expenditure  for  research, 
development,  test,  and  evaluation  of  more  than  $365  million  (FY  2000  constant 
dollars)  or  procurement  of  more  than  $2.19  billion  (FY  2000  constant  dollars), 
or  one  designated  by  the  Under  Secretary  to  be  a  major  defense  acquisition 
program. 

Milestone  Decision  Authority.  A  milestone  decision  authority  is  the  individual 
designated  to  approve  entry  of  an  acquisition  program  into  the  next  acquisition 
phase. 

Nonextensible  Fuel  Cell.  A  nonextensible  fuel  cell  is  made  of  high-strength 
flexible  material  that  is  able  to  absorb  crash  energy  with  minimal  expansion. 

Operational  Test  and  Evaluation.  Operational  test  and  evaluation  is  the  field 
test,  under  realistic  conditions,  of  any  item  or  key  component  of  weapons, 
equipment,  or  munitions  for  the  purpose  of  determining  the  effectiveness  and 
suitability  of  the  weapons,  equipment,  or  munitions  for  use  in  combat  by  typical 
military  users;  and  the  evaluation  of  the  results  of  such  tests. 


20 


Program.  A  program  is  an  acquisition  effort  funded  by  research,  development, 
test  and  evaluation  or  procurement  appropriations,  or  both,  with  the  express 
objective  of  providing  a  new  or  improved  capability  in  response  to  a  stated 
mission  need  or  deficiency. 

Retrofit.  Retrofit  is  a  modification  of  a  configuration  item  to  incorporate 
changes  made  in  later  production  items. 

Rework.  Rework  is  any  correction  of  defective  work,  either  before,  during,  or 
after  inspection. 

Safety  Action  Record.  A  safety  action  record  is  a  summary  of  a  single, 
identified  hazard,  including  the  chronological  history  of  a  hazard’s  identification 
and  resolution.  A  safety  action  record  is  generated  for  hazards  having  the 
highest  risk  and  is  not  the  same  as  a  system  safety  risk  assessment. 

Selected  Acquisition  Report.  A  selected  acquisition  report  is  a  standard, 
comprehensive,  summary  status  report  of  a  major  defense  acquisition  program, 
which  is  required  for  periodic  submission  to  Congress.  The  report  includes  key 
cost,  schedule,  and  technical  information. 

Sponson.  A  sponson  is  a  projection  from  the  side  of  the  aircraft  that  holds  the  fuel 
cells  and  the  landing  gear. 

System  Safety  Risk  Assessment.  A  system  safety  risk  assessment  assigns  a 
risk  level  to  a  specific  hazard,  in  this  case  the  fuel  cells,  in  terms  of  frequency 
of  occurrence  and  severity  related  to  injury,  property  damage,  or  effect  on 
mission. 

Type  Certification.  Type  certification  is  a  process  conducted  by  the  Federal 
Aviation  Administration  to  determine  the  airworthiness  of  a  specific  type  of  aircraft. 

Vortex  Ring  State.  Vortex  ring  state,  also  known  as  power  settling,  occurs 
when  a  very  slow-flying  helicopter  or  tilt-rotor  in  helicopter  mode  begins  to 
descend  into  the  disturbed  air  directly  under  its  rotor  system.  This  disturbed  air 
is  recirculated  through  the  rotor  system  and  results  in  a  decrease  in  lift  provided 
by  that  rotor  disk.  As  rates  of  descent  significantly  increase,  the  pilot's 
instinctive  reaction  is  to  add  power  in  an  attempt  to  arrest  his  sink  rate. 
However,  when  he  adds  power,  he  creates  a  greater  volume  of  unstable  air 
under  the  aircraft,  which  causes  the  rotorcraft  to  descend  at  an  even  faster  rate. 

Waiver.  A  waiver  is  a  written  authorization  to  accept  a  configuration  item  or 
other  designated  item,  which,  during  production  or  after  having  been  submitted 
for  inspection,  is  found  to  depart  from  specified  requirements,  but  nevertheless 
is  considered  suitable  “as  is”  or  after  rework  by  an  approved  method. 
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Appendix  D.  V-22  Aircraft  Configurations 
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Aft  Sponson  Forward  Sponsons 
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Appendix  E.  Fuel  Cell  Waiver  Request  and 

Approval 
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CCB  CHANGE  REQUEST/DIRECTIVE 


H^*|p.NST  mtU£ 


1.  TYPE  OF  CHANGE 

(  I  CCP  (  1  DEVIATION 

(  )  RAMEC  (  \  MG  PEL 

(X)  WAIVER 


G  ORIGINATOR: 

NAVAIR  i  BELL-BO  E1NG 


Z .  CHANGE  NO 

V-22-W-L004  f 4 


JUST.  CODE 

N/A 


3.  DOCUMENT  TRACKING  NO 

N/A 


S.  CCB  NG.  DATE: 

99 F -00 6  16  OCT  9B 


7.  NATURE  OF  CCB  ACTION: 

EX)  INITIAL  REQUEST  |  )  URGENT 

[  ]  REVISION  {XI  ROUTINE 

t  ]  FOLLOW  ON  BUY  (X)  HANDCARRY 
I  }  ADMIN  REQUEST 


S.  PROGRAM  MANAGER  SPONSORING  THIS  CHANGE  I  SIGNATURE  AND  DATE}: 

BARBARA  SMITH 


11.  TITLE  OF  CHANGE 

Sponson  Fuel  Cells 


13  CONFIGURATION  ITEMS  AFFECTED  AND  EFFECTIVITY: 

LRIP  Aircraft  D0011  -  DQ029 


IS,  OTHEH  CONFIGURATION  ITEMS  AFFECTED  AND  EFFECTIVITY 

None 


17.  REFERENCES 

BB  Llr  JPO-4560-9B:BV  dated  October  12,  1998 


3-  CODE 
PMA-275A 


TO. PHONE 
1301)  757- 
5101 


12.  TYPE  OF  IMPLEMENTATION: 
(  )  EWID 

(XI  PRODUCTION  ILRIPI 
(  >  ATTHTTIOK 

OSIP  NO. 


14.  TD  CATEGORY  -  N/A 
I  J  IMNIED  El  ROUTINE 
(  S URGENT  {  i HfcvORP 


16.  TECHNICAL  DIRECTIVE  N/A 
TYPE  NO . 


18.  JUSTIFICATION 


I  he  Sponsor!  Fuel  Cells  have  not  passed  the  qualification  drop  test  or  gunfire  requirements  of  MIL-27422B.  They  also 
do  meet  the  acceptance  and  inspection  standards  of  MIL  27422B  and  M1L-STD-801  Request  that  inspection  and 
acceptance  criteria  be  defined  as  detailed  in  ILC  Document  1072-70016  dated  9/98  (as  attached  to  the  waiver  request).  The 
revised  acceptance  criteria  allows  a  limited  number  of  areas  of  non  adhesion  with  quantity  and  location  restrictions  that 
exceed  MIL-STD-flOI.  Revised  criteria  also  allows  wrinkles  in  certain  areas  outside  of  MIL-STD-801  requirements. 


13.  CCB  MEMBERS 

st 

CODE 

20.  REMARKS  (CCB  CHAIRMAN  ONL  Y! 

AIR-3.1  _2H 

i 

AIR-4.1.2 

AVIA IIUN  TRAINING 

_ / _ _ _ _ 

ccd  cm  ms  man  -  Ms.  Mf  Jansen  f  Ms.  B.  Smith 

PMA-275D5 
PM  A -275 A 

21.  (jtf  approved  22.  DATE 

(  J  DISAPPROVED  fZ/l 

NAVJMJUiarf  (J-52) 


25 


Appendix  F.  Office  of  the  Inspector  General  of  the 
Department  of  Defense  Memorandum 

Concerning  Noncrashworthy  Fuel  Cells 


fNSPECTOR  GENERAL 
DEPARTMENT  CF  DEFENSE 
400  ARMY  NAVY  DRIVE  _ 

ARLINGTON,  VIRGINIA  2S2Q2-4704  MAR  j  3  2902 


MEMORANDUM  FOR  UNDER  'SECRETARY  OF  DEFENSE  FOR  ACQUISITION , 
TECHNOLOGY ,  AND  LOGISTICS 

SUBJECT:  Noncrashworthy  Fuel  Cells  on  the  V-22  Osprey  Joint 

Advanced  Vertical  Aircraft  (Project  No.  D20Q2AE-G065) 


During  the  course  of  our  ongoing  review  of  allegations  about 
the  fuel  cells  on  the  V-22  aircraft,  it  came  to  our  attention 
from  technical  personnel  at  the  Program  Office  that  none  of  the 
sponson  fuel  cells  on  the  four  V-22  engineering  and  manufacturing 
development  (EMD)  aircraft  (Build  Numbers  1,  S,  9,  and  10)  have 
passed  the  65-foot  drop  test.  The  military  specification  for  the 
fuel  cells  requires  that  the  V-22  fuel  cells  be  crashworthy  and 
self -  seal! ng ,  and  designed  to  withstand  a  65 -foot  drop  without 
leaking.  Those  four  aircraft  are  scheduled  to  be  used  in  flight 
testing  in  April-  2002,  . 

Our  upcoming  report  will  recommend  that  those  four  EMD 
aircraft  be  retrofitted  with  crashworthy  fuel  cells  to  meet  the 
65- foot  drop  test  requirement  before  being  used  in  flight 
testing.  Because  of  the  impending  scheduled  flight  testing  in 
April  2002,  a  timely  and  informed  decision  needs  to  be  made  as  to 
whether  the  risk  of  flying  the  EMD  aircraft  with  noncrashworthy 
fuel  cells  is  acceptable „ 

We  are  in  the  process  of  completing  our  audit  work  andj  plan 
to  issue  the  draft  audit  report  by  mid-April  2002,  We  bring  this 
issue  on  flying  EMD  aircraft  without  compliant  fuel  cells  to  your 
attention  because  of  its  time  sensitivity  and  importance.  If  you 
have  any  questions,  please  contact  me  or  Mr.  John  E.  Meling  at 
(703)  604-9091  ( j  mel ing@dodi g . gad .  mil )  . 


Robert  J .  Lieberman 
Deputy  Inspector  General 


cc :  Secretary  of  the  Navy 

Commandant  of  the  Marine  Corps 
General  Counsel  of  the  Department  of  Defense 
Assistant  Secretary  of  the  Navy  [Research,  Development, 
and  Acquisition). 

Director,  Operational  Test  and  Evaluation 
Director,  Defense  Contract  Management  Agency 
Naval  Inspector  General 
Commander,  Naval  Air  Systems  Command 

Program  Executive  Officer,  Air  Anti- Submarine  Warfare, 
Assault,  and  Special  Missions  Programs 
V-22  Program  Manager 
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Appendix  G.  Under  Secretary  of  Defense  for 

Acquisition,  Technology,  and  Logistics 
Memorandum  Concerning 
Noncrashworthy  Fuel  Cells 


ACQUISITION, 
TECHNOLOGY 
AMD  LOGISTICS 


THE  UNDER  SECRETARY  OF  DEFENSE 

3010  DEFENSE  PENTAGON 
WASHINGTON.  DC  £0301-3010 


93  APR  W® 


MEMORANDUM  FOR  DEPUTY  INSPECTOR  GENERAL 


SUBJECT:  Non -crashworthy  Fuel  Cells  on  the  V-22  Osprey  Joint  Advance 
Vertical  Aircraft  (Project  No.  D20GAE-0065) 


This  responds  to  your  March  1 5,  2tX12,  memo  regarding  your 
recommendation  not  to  conduct  V-22  development  testing  without  crashworthy 
fuel  cells  that  have  passed  the  65-foot  drop  test. 

Attached  is  the  Commander,  Naval  Ah’  Systems  Command's  assessment  of 
risk  associated  with  testing  the  V-22  with  its  current  aft  sponson  fuel  cell 
configuration.  I  concur  with  his  assessment  and  support  his  decision  to  return  to 
developmental  testing  with  the  current  fuel  cell  configuration. 

I  feel  the  benefits  of  returning  to  flight  as  scheduled  to  address  my  other 
technical  concerns  outweigh  the  limited  risk  reduction  attained  by  retrofitting  the 
aircraft  with  crashworthy  fuel  cells  that  have  passed  the  65 -foot  drop  test  prior  to 
development  testing.  My  POC  is  Mr.  Gary  Gray,  Staff  Specialist,  (703)  697-0638 

E.C  Aldridge,  Jr. 


Attachment: 
As  stated 
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DEPARTMENT  OF  THE  NAVY 

NAVAL  *|R  SVSLn-MSCCtfMAUD 
WILIAM  A,  H»» FT  SCjILDINO 
<71*3  «USS  flOAO,  ftt.CiC  a'2H 

FATJLXEMT  PIVER,  MARYLAND  2«7*  1M7  ■ 

28  Mar  02 


MEMORANDUM  FOR  UNDER  SECRETARY  OF  DEFENSE  FOR  ACQUISITION, 
TECHNOLOGY,  AND  LOGISTICS 

SUBJECT:  Noncrash  worthy  Fuel  Cells  on  the  V-22  Osprey  Joint  Advanced  Vertical 
Aircraft  (DODIG  Project  No.  D2002 AE-0065) 

The  DODIG  in  a  March  15,  2002  memo  recommended  that  prior  to  flight  tests  V-22 
aircraft  used  for  developmental  testing  should  be  retrofitted  with  crashworthy  sponsor!  fuel  cells 
that  have  passed  a  65 -foot  drop  test.  The  design  of  the  sponson  fuel  cells  in  the  V-22  aircraft  that 
will  be  used  for  upcoming  developmental  testing  was  reviewed  as  part  of  the  V-22  Flight 
Readiness  Review  (FRR)  process.  The  V-22  Program  Office  and  the  Naval  Air  Systems 
Command  V-22  Engineering  Team  determined  that  the  risk  was  acceptable  to  conduct  the 
planned  flight  test  program  with  existing,  fuel  system  configuration  which  meets  all  crashworthy 
specifications,  with  the  exception  of  the  final  65 Toot  fUel  cell  sponson  drop  test. 

The  FRR  determination  concerning  the  sponson  fuel  cells  was  based  the  limited  risk 
exposure  in  the  controlled  and  structured  developmental  test  environment  in  which  the  test 
aircraft  will  be  operated.  Highly  trained  pilots  fly  the  test  aircraft  that  are  heavily  instrumented 
and  tracked  with  telemetry.  The  test  squadron  provides  significant  oversight  of  testing  and  a 
safety  assessment  is  conducted  for  each  test  plan  and  every  flight.  Also,  no  passengers  will  be 
carried. 

The  Naval  Air  Systems  Command  has  conducted  a  thorough  system  safety  assessment  of 
the  V-22  as  part  of  the  FRR  including  the  fuel  system  and  existing  fuel  cells  on  the  test  aircraft. 
The  determination  concerning  sponson  fuel  cells  was  the  risk  of  conducting  developmental 
testing  with  the  existing  fuel  cells  was  within  manageable  flight  test  boundaries. 


J.  W.  DYER 

Vice  Admiral,  U,S,  Navy 
cc: 

Program  Executive  Officer,  Air  Anti-Submarine  Warfare,  Assault,  and  Special 
Missions  Programs 

Assistant  Commander  for  Research  and  Engineering,  Naval  Air  Systems  Command 
V-22  Program  Manager 
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Appendix  H.  Under  Secretary  of  Defense  for 

Acquisition,  Technology,  and  Logistics 
Memorandum  Concerning  Installation  of 

V-22  Fuel  Cells 


THE  UNDER  SECRETARY  OF  DEFENSE 

3010  DEFENSE  PENTAGON 
WASHINGTON,  DC  20301-3010 

o  6  HAY  7m 

ACQUISITION, 

TECHNOLOGY 
WO  LOGISTICS 

MEMORANDUM  FOR  DEPUTY  INSPECTOR  GENERAL 

SUBJECT:  Fuel  Cells  on  the  V-22  Osprey  Joint  Advance  Vertical  Aircraft 
(Project  No.  D2002AE-0065) 


This  responds  to  your  April  16, 2002,  memo  requesting  comments  on  your 
draft  audit  report  on  Fuel  Cells  of  the  V-22  Osprey  Joint  Advanced  Vertical 
Aircraft. 

You  recommended  that  I  direct  the  Assistant  Secretary  of  the  Navy 
(Research,  Development  and  Acquisition)  to  require  installation  of  sponson  fuel 
cells  that  comply  with  crashworthiness  and  ballistic  standards  in  existing  V-22 
aircraft,  including  4  engineering  and  manufacturing  development  aircraft  and  1 7 
low-rate  initial  production  aircraft  from  Lots  1  through  3,  before  flying  those 
aircraft. 

Aft  V-22  aircraft,  Lot  1  and  higher  will  have  crashworthy  and  ballistic 
compliant  fuel  cells  installed.  The  only  exception  will  be  aircraft  used  in 
engineering  and  manufacturing  development  (EMD)  testing.  A  formal  risk 
assessment  process  was  used  to  evaluate  the  current  fuel  cell  configuration  in 
those  aircraft.  The  risk  assessment  has  been  documented  in  a  Safety  Action 
Record  (SAR).  This  risk  was  assessed  as  ID  (medium)  risk. 

I  have  again  considered  this  risk,  and  still  conclude  that  the  benefits  of 
returning  to  flight  as  scheduled  to  address  my  other  technical  concerns  outweigh 
the  limited  risk  reduction  attained  by  retrofitting  fuel  cells  with  greater 
crashworthiness. 


E.C.  Aldridge,  Jr. 
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Appendix  I.  Under  Secretary  of  Defense  for 

Acquisition,  Technology,  and  Logistics 
Memorandum  Concerning  Safety  of  V-22 

Fuel  Cells 


THE  UNDER  SECRETARY  OF  DEFENSE 

3010  DEFENSE  PENTAGON 
WASHINGTON,  DC  20301*3010 

i  s  m  mi 


MEMORANDUM  FOR  DEPARTMENT  OF  DEFENSE  INSPECTOR  GENERAL 
SUBJECT:  Safety  of  the  V-22  Osprey  Joint  Advanced  Vertical  Aircraft 


This  memo  responds  to  your  draft  memorandum  to  the  Deputy  Secretary  of 
Defense  on  fully  compliant  crashworthy  fuel  cells. 

The  Navy  specifically  addressed  the  fuel  cell  issue  at  a  Flight  Readiness 
Review  on  March  21,  2002,  The  Navy  assessed  the  marginal  increased  risk  of 
using  the  existing  fuel  cells  on  the  Engineering  and  Manufacturing  Development 
aircraft  as  medium  risk  compared  to  the  fully  compliant  fuel  cells  that  passed  the 
65 -foot  drop  test. 

On  two  prior  occasions,  I  supported  the  Navy's  assessment.  Since  that 
time,  the  Navy  has  formally  documented  its  process.  This  formal  risk  assessment 
should  satisfy  your  recommendation  to  document  and  provide  increased  rigor  to 
the  Navy's  assessment. 


ACQUISITION. 
TECHNOLOGY 
AND  LOGISTICS 
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Appendix  J.  System  Safety  Risk  Assessment  of 
Engineering  and  Manufacturing 
Development  V-22  Noncompliant  Sponson 

Fuel  Cells 


FRA  2002-13 


SYSTEM  SAFETY  FORMAT.  RISK  ASSESSMENT 

This  risk  assessment  represents  an  additional  effort  in  response  to  a  memo  to  Deputy  Secretary 
of  Defense  from  Joseph  Schmitz,  dated  05/22/02.  The  initial  activity  for  this  hazard  has  been 
provided  in  Safety  Action  Record  (SAR)  46-17  Crash  Related  Fuel  Leak  -  Fuel  Cell  /  Component 
Separation  -  March  1 995. 


Date:  24  May  2002 

1 .  Type/Model/Series:  EMD  V-22  (Aircraft  7-10) 

2.  System/Subsystem:  Fuel  System 

A.  Assembly/Part:  Sponson  Fuel  Tanks 

3*  Hazard  Identification: 

A,  Risk  Assessment  Name:  EMD  V-22  Non-Compliant  Sponson  Fuel  Cells 

B .  Description  of  Hazard : 

Failure  to  adequately  contain  fuel  following  a  mishap  that  could  result  in  a  post  crash  fire 
and  aircrew  fatal  injury.  This  assessment  evaluates  the  hazard  associated  with 
conducting  Engineering  and  Manufacturing  Development  (EMD)  flight  test  operations 
with  extensible  sponson  fuel  tanks. 

The  V-22  Bell-Boeing  Engineering  and  Manufacturing  Development  Specification  (SD- 
572-1)  identified  a  crashworthy  fuel  system  design  based  on  MIL-STD-1290,  with 
reduced  requirements  of  MIL-T-27422B.  Testing  of  EMD  fuel  tank  configurations  met 
these  crashworthy  specifications,  wi  th  the  exception  of  the  sponson  tanks  that  did  rtot 
pass  the  65 -foot  drop  test  requirement.  Based  on  these  test  results,  the  program  office 
continued  to  conduct  development  work  on  the  fuel  system  in  order  to  obtain  a  fully 
compliant  crashworthy  fuel  system. 

To  assess  the  overall  impact  the  extensible  type  fuel  tanks  have  on  the  V-22  fuel  system 
crashworthiness,  it  is  important  to  recognize  the  fundamental  differences  between  the 
extensible  and  nou-extensible  fuel  tank  approach  to  crashworthiness,  Non-extensible 
MIL-T-27442B  crashworthy  fuel  tanks  absorb  crash  energy  without  substantial 
assistance  from  the  surrounding  structure.  On  the  other  hand,  extensible  type  fuel  tank 
construction  dissipates  crash  energy  through  elastic  deformation  of  the  tank  into  gaps  in 
the  fuel  tank  cavity  allowing  loads  to  be  transferred  into  all  structural  boundaries  it 
contacts.  If  at  the  time  of  the  crash,  sharp  edges  or  protrusions  exist  due  to  local 
structural  failures  then  the  probability  that  the  bladder  may  tear  is  increased  over  that  of 
non-extensible  tanks.  This  is  primarily  due  to  the  fact  that  the  puncture  and  tear 
resistance  of  the  extensible  fuel  tank  is  considerably  less  than  that  of  the  non-extensible 
tank  construction.  The  exact  degree  of  reduced  capability  is  not  easily  quantified  since 
the  fuel  tank  qualification  drop  tests  per  MIL-T-27442  which  use  a  65  foot  drop  as  a 
technique  to  verify  crashworthiness  are  conducted  for  the  tanks  alone  and  not  with  the 
tanks  installed  in  representative  structure. 
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C  Hazard  Classification: 

1 )  Hazard  Severity  Code:  I  Catastrophic 

2)  Hazard  Probability  Code:  D  Remote 

3)  Risk  Level:  ID  Medium 

4.  Explanation  of  severity/probability  of  this  hazard: 

A.  Hazard  Severity:  Catastrophic:  This  is  based  on  the  "worst  credible"  outcome,  the 
likelihood  that  a  post  crash  fire  results  in  occupant  fatality  due  to  inability  for  occupants 
to  egress  the  aircraft.  In  order  for  this  hazard  to  be  realized,  a  crash  is  required  that  is 
severe  enough  to  release  fuel  from  the  tanks  in  the  presence  of  an  ignition  source,  yet  not 
so  severe  that  it  would  be  a  non-survivable  crash. 

B.  Hazard  Probability:  Remote  (1/100,000  fit.  hrs  >Pr>  .  1/1 00,000  fit.  hrs)  -Unlikely  but 
possible  to  occur  in  the  life  of  an  item.  Qualitative  &  quantitative  analysis  is  provided 
below: 

Qualitative  Considerations:  Actual  crash  experience  exists  for  the  V-22.  During  Full 
Scale  Development  (FSD),  the  V-22  program  suffered  two  major  mishaps.  Aircraft  4 
crashed  into  a  river  at  a  velocity  greatly  beyond  design  criteria  (in  excess  of  100 ft/sec); 
as  in  other  high-G  impacts,  performance  of  the  fuel  system  crashworthiness  features  was 
not  assessed  in  the  mishap  investigation.  Aircraft  5  experienced  a  roll  and  came  to  rest 
inverted.  The  crash  was  survivable  with  no  loss  of  crew.  While  it  was  not  a  high-end 
crash,  the  orientation  of  the  crash  was  not  anticipated.  The  impact  force  was  sufficient 
enough  to  separate  (peel  back)  the  wing  from  the  fuselage  and  initiate  separation  of  the 
cockpit  from  the  cabin  structure.  This  wing  failure  mode  had  not  been  accommodated 
for  in  the  FSD  design  and  a  mid  wing  fire  occurred.  This  failure  mode  was  considered  as 
part  of  the  EMD  redesign  effort  and,  additional  breakaway  valves  and  flexible  high- 
elongation  lines  have  been  incorporated  into  the  aircraft  to  replace  rigid  fuel  tines.  The 
extensible  tanks  themselves  performed  well,  remaining  intact  and  they  did  not  exhibit 
any  leakage.  In  the  most  recent  V-22  mishaps,  involving  production  aircraft  over  land, 
the  forces  were  beyond  aircraft  crashworthiness  design  requirements.  A  post-impact 
fuel-fed  fire  ensued.  Analysis  of  the  fuel  system  contribution  to  this  incident  was  not 
conducted. 

The  EMD  tank  material  construction  was  identical  to  FSD.  However,  the  EMD  tank  is 
slightly  thicker  due  to  a  heavier  gauge  power  layer.  Reconfiguration  of  the  tanks 
occurred  due  to  sponson  redesign. 

Developmental  flight  testing  will  be  conducted  in  a  controlled  environment  and  a 
majority  of  the  testing  will  be  conducted  over  water  on  the  east  coast.  The  flight  testing 
planned  for  the  West  Coast  is  related  to  the  Multi-Mode  Radar  (MMR).  This  testing  will 
be  conducted  during  day  VMC  conditions  and  is  considered  low  risk  flying.  Unlike  fleet 
operational  flying,  the  EMD  flight  test  environment  is  structured  and  controlled.  The 
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following  factors  will  qualitatively  reduce  the  probability  of  experiencing  a  Class  A 
mishap  during  the  EMD  flight  test  program: 

*  A  thorough  subsystem  and  system  level  assessment  was  conducted  to  identify  and 
mitigate  risk  associated  with  continued  EMD  flight  operations. 

*  EMD  aircraft  are  instrumented;  aircraft  8  and  10  will  utilize  real  time  telemetry  for 
every  flight. 

*  Developmental  Test  (DT)  flight  test  will  be  limited  to  DT  flight  crews  only. 

*  Highly  trained  contractor/government  flight  crews  with  egress  training  currency. 

*  Si  gnifican  t  o versi  ght  by  test  squadrons,  Defense  Contract  Management  Agency 
(DCMA)  and  the  program  office. 

*  A/C  maintenance  inspection  intervals  are  very  conservative  compared  to  planned 
fleet  operations. 

*  Testing  approach  is  conservative  (pilots  will  Return  to  Base  (RTB)  after  first  non- 
resettable  caution). 

*  A  Test  Hazard  Analysis  will  be  performed  for  each  test  plan. 

Quantitative  Considerations:  The  probability  of  experiencing  the  identified  hazard 
considers  the  likelihood  that  a  survivable  crash  occurs,  crash  forces  exceed  the  capability 
of  the  tanks,  an  ignition  source  is  present  and  the  occupants  are  not  able  to  egress  the 
aircraft.  In  order  for  this  risk  to  be  realized,  a  crash  is  required  that  is  severe  enough  to 
defonn  the  airframe  yet  not  so  severe  that  it  would  fatally  injure  the  aircrew  upon 
impact. 

Assumptions: 

Probability  of  a  crash:  (2-10/100,000  flight  hours)  -  The  historic  Class  A  helicopter 
mishap  rate  for  the  Navy/Marine  Corp  has  been  about  2  to  3  per  100,000  hours.  Class  A 
mishaps  are  defined  as  those  that  exceed  a  1  million  dollar  threshold  in  a/c  damage 
and/or  those  that  result  in  one  or  more  fatalities,  A  lower  rate  of  2  mishaps/ 100,000  and 
higher  rate  of  10  mishaps/ 100,000  is  presented  to  capture  design  maturity  concerns  that 
could  result  in  a  higheT  mishap  rate  than  that  associated  with  a  production  representative 
platform  (reference  11) 

Probability  that  a  crash  is  survivable:  (50%)  -  Historical  evidence  suggests  that 
approximately  50%  of  all  class  A  mishaps  are  non-survivable  (Crash  forces  are  beyond 
MiI-Std-1 290  impact  conditions). 

Probability  that  the  crash  occurs  over  laud:  (50%)  -  Historical  data  indicates 
approximately  50%  of  Navy/Marine  Corp  mishaps  occur  over  land.  It  is  assumed  that  in 
the  case  of  a  water  impact,  the  probability  of  the  postcrash  fire  yielding  a  fatality  is 
negligible. 

Probability  that  the  fuel  tank  is  compromised  during  a  crash  condition:  (50%)  - 
The  probability  that  an  extensible  lank  is  compromised  will  be  a  function  of  the 
magnitude  of  the  crash.  The  V-22  landing  gear  is  capable  of  attenuating  impact 
velocities  up  to  24  ft/sec.  The  function  of  the  landing  gear  system  in  a  crash  situation  is 
to  provide  controlled  loading  and  energy  attenuation.  Deceleration  loads  experienced  by 
the  extensible  tanks  during  a  24  ft/sec  crash  are  not  anticipated  to  compromise  the 
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integrity  of  the  tank.  Impacts  beyond  24  ft/sec  could  impart  significant  loading  to  the 
extensible  fuel  cells.  It  is  therefore  conservatively  assumed  that  fuel  leakage  will  occur 
for  impact  velocities  above  24  ft/sec.  It  is  also  assumed  (and  historically  supported)  that 
approximately  50%  of  the  survivable  mishaps  will  have  an  impact  velocity  of  greater 
than  24  ft/sec. 

Probability  that  an  ignition  source  is  present  following  a  postcrash  fuel  spill: 
(100%)  -  The  potential  exists  for  fuel  to  be  ignited  by  electrical  sources  or  hot  surface 
ignition.  Because  of  the  uncertainty  associated  with  the  post  crash  environment,  a 
conservative  approach  is  adopted  and  the  probability  of  the  presence  of  an  ignition 
source  is  assumed  to  be  1 00%, 

Probability  that  occupants  are  not  able  to  egress  the  aircraft  during  a  postcrash 
fire:  (50%)  -  This  accounts  for  the  fact  that  in  some  cases,  occupants  will  be  able  to 
egress  the  aircraft  following  a  crash  and  subsequent  postcrash  fire.  Safe  egress  during 
flight  test  is  more  likely  than  fleet  operations  due  to  fewer  personnel  and  less  cargo 
onboard.  The  assumption  is  that  in  50%  of  the  cases,  egress  routes  will  be  blocked  or 
debilitating  injuries  will  prevent  egress  and  aircrew  fatalities  will  occur  (i.e.  crew/cabin 
occupants  do  not  have  adequate  time  to  egress  the  a/c  prior  to  succumbing  to  smoke 
inhalation  or  fire). 

Hazard  Probability  Calculations 

2  x  ,5  x  .5  x  ,5  x  1  x.5  =  .125  events  per  hundred  thousand  flight  hrs,  =  D  (Remote) 

10  x  .5  x  ,5  x  ,5  x  1  x  .5  =  .625  events  per  hundred  thousand  flight  hrs,  =  D  (Remote) 


5.  List  of  Sources  and  References: 

1 .  SD-572-1C,  Detail  Design  Specification  for  V-22  Engineering  and 
Manufacturing  Development,  13Sep95. 

2.  M1L-STD-882B,  Standard  Practice  for  System  Safety  Program  Requirements, 
28JunS7, 

3.  MIL-STD-I290,  Light  Fixed  and  Rotary  Wing  Aircraft  Crashworthiness,  21  Jul77, 

4.  M1L-T-27422B  Military  Specification,  Tank,  Fuel,  Crash-resistant,  Aircraft, 
13Apr7L 

5.  V-22  5AR  46-17,  Crash  Related  Fuel  Leak-  Fuel  Cell/Component  Separation, 
initiated  17Mar95 

6.  Flight  Certification  Rationale  for  V-22  Sponson  Fuel  Cells, 
FPT/DES/TLW/MRM/1404,  FPT  Industries,  Sept.  24,  1996, 

7.  V-22  System  Safety  Working  Group  22,  3Oct0l ,  Patuxent  River  NAS,  MD, 
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£♦  Aircraft  Crash  Survival  Design  Guide  Vols,  I-V.  USAVSCOM  TR  89-D-22E,  dtd. 

December  1989, 

9.  The  Naval  Accident  Environment,  Helicopter  Aircrew  Survivability  and  Structural 

Response,  Joseph  W.  Coltman,  dtd.  16  October  1 984. 

10.  Report  of  the  Panel  to  Review  the  V-22  Program,  30Apr0J . 

11.  US  Navy  Safety  Center  Internet  web  site,  http://safetyccnter.navy.mil 
6.  Background  Material: 

GENERAL  CWFS  BACKGROUND:  Crashworthy  Fuel  Systems  (CWFS)  are  designed 
to  contain  fuel  during  a  survivable  crash,  ,  All  current  US  Navy  helicopter  fuel  systems, 
except  the  H-3  series  and  TH-57  B/C  Jet  Ranger  aircraft,  impose  some  CWFS 
requirements  as  defined  in  MIL-STD-1290,  “Light  Fixed  and  Rotary  Wing  Aircraft 
Crashworthiness”  MIL-STD-1290  specifies  that  fuel  spillage  during  and  after  all 
survivable  crash  impacts  of  the  severity  of  up  to  and  including  the  95  percentile 
survivable  accident  be  minimized  through  the  use  of  crashworthy  fuel  tanks,  self-scaling 
breakaway  valves,  prudent  fuel  line  routing,  rollover  vent  system  protection,  etc. 
Crashworthy  fuel  tanks  are  defined  in  MIL-STD-1290  as  those  meeting  MIL-T-27422B, 
the  crashworthy  fuel  tank  specification  that  calls  out  design  characteristics  and  test 
requirements.  Breakaway  valves  defined  in  MIL-STD-1290  should  be  utilized  at  all  fuel 
tank  to  fuel  line  connections  and  other  points  in  the  fuel  system  where  aircraft  structural 
deformations  could  lead  to  fuel  spillage,  M1L-T-27422B  requirements  emanated  from 
extensive  fuel  system  crash  tests  conducted  during  the  Vietnam  War  period  when 
otherwise  survivable  helicopter  crashes  were  resulting  in  fatalities  exacerbated  by  fuel 
tank  ruptures.  Testing  showed  that  tear  and  puncture  resistance,  standards  for  fitting 
pullout  and  65  ft  drop  tests  were  the  key  factors  in  fuel  tank  ability  to  meet  fuel  system 
crashworthiness  requirements  of  MIL-STD-1290, 

V-22  CWFS  BACKGROUND:  The  V-22  Bell-Boeing  Engineering  and  Manufacturing 
Development  Specification  (SD-572-1,  reference  1)  calls  for  a  crashworthy  fuel  system 
design  based  on  MEL-STD-1290  and  MIL-T-27422B,  During  the  early  stages  of  the  V- 
22  program,  to  obtain  a  significant  aircraft  weight  savings,  Bell-Boeing  and  the  Navy 
considered  the  use  of  an  extensible  fuel  tank  construction  vice  the  non-extenstble  fuel 
tank  construction  typically  used  in  other  US  Navy  helicopter  CWFS,  Essentially, 
extensible  tanks  dissipate  crash  loads  by  locally  elongating  while  non-extensiblc  tanks 
absorb  crash  loads  with  minimal  deformation.  This  fundamental  difference  in  the  design 
approach  to  achieve  crashworthiness  results  in  employment  of  materials  in  extensible 
tanks  that  at  present  are  less  puncture  and  tear  resistant  than  materials  used  in  non- 
extensible  tanks  .  Extensible  tanks  may  thus  offer  a  lesser  degree  of  crashworthiness  than 
that  of  non-extensible  tanks.  There  arc  tradeoffs  among  all  of  the  crashworthiness 
factors,  and  even  within  the  postcrash  survival  category,  compromises  must  be  made  to 
avoid  excessive  adverse  effects  on  mission  capability.  After  considering  overall  aircraft 
requirements,  a  decision  was  made  to  employ  extensible  fuel  tanks  in  the  wing  and 
sponsons.  To  this  end  and  to  acknowledge  that  a  qualified  extensible  design  could 
provide  crashworthiness,  SD-572-1,  while  retaining  requirements  for  traditional  MIL  T- 
2742 2B  fuel  tanks,  added  as  an  alternate  tank  the  specific  performance  requirements  that 
accommodated  the  unique  mechanical  properties  of  extensible  fuel  tanks.  Specifically, 
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for  extensible  designs,  the  tear  resistance,  impact  penetration,  tensile  strength/ultimate 
elongation,  fitting  strength  and  gunfire  requirements  were  reduced  from  those  of 
traditional  M1L-T-27422B  tanks.  SD-572-1  retained  requirements  that  the  V-22  meet 
other  CWFS  requirements  in  accordance  with  MIL-STD-1290A 


EMD  V-22  FUEL  TANK  DESIGN  STATUS:  The  following  is  information  regarding 
the  CWFS  on  EMD  aircraft.  Additionally,  Table  1  provides  a  comparison  of  the  SD- 
572-1  and  M1L-T-27422B  fuel  tanks  requirements. 


*  Sponson  Tanks  (2  Fwd  and  1  Aft)-Extensible  Construction.  Failed  65  ft.  drop 
test  (Not  fully  qualified  to  SD-572  crashworthy). 

*  Total  of  16  breakaway  valves.  Breakaway  valves  are  fully  qualified.  The 
breakaway  valves  are  located  at  all  fuel  tank  to  fuel  line  interfaces  (7),  BL  38 
(2),  twist  capsule  wing  break  (2),  sponson  vent  lines  (3)  and  APU  fuel  line  (2), 
The  locations  and  the  design  of  the  breakaway  valves  meet  the  requirements  of 
MIL-STD-1290. 

*  Frangible  fittings,  rollover  provisions,  high  elongation  hoses,  etc  are  utilized  as 
part  of  the  postcrash  fuel  containment  approach. 


TABLE  I 


COMPARISON  OF  RELEVANT  SD-572- 1  AND  MIL-T-27422B  FUEL  TANK 
REQUIREMENTS 


REQUIREMENT 

SD-572-1 

MIL-T-27422B 

Constant  Rate  Tear 

40  ft.dbs 

400  fl.-lbs. 

Impact  Penetration 
(Throat  Size) 

20  in.-square 

4.0  in.-square 

Fitting  Strength  [secure 
to  tank  structure] 

Shall  elongate  a  minimum 
of  250%  prior  to  failure 

200  lb  load  attached  to  fitting 
and  dropped  from  20ft. 

Composite  Material 
Strength 

Tensile  strength  and 
ultimate  elongation  shall 
not  be  less  than  901bs.-in. 
and  350% 

4  in.  diameter  plunger  shall  be 
forced  into  the  center  of  the 
panel  at  a  rate  of  20in.  per 
minute  until  failure 

In  addition  to  V-22  program  risk  assessments,  both  the  Panel  to  review  the  V-22  Program 
(Blue  Ribbon  Panel,  reference  10)  and  the  DOD IG  reviewed  the  V-22  program  and 
examined  the  crashworthiness  of  the  fuel  system.  The  Blue  Ribbon  Panel  completed  their 
review  in  April  2001,  recommending  the  program  office  retrofit  all  operational  aircraft  at 
the  first  opportunity.  The  panel  did  not  believe  the  marginal  additional  risk  associated 
with  the  non-compliant  fuel  system  warranted  the  grounding  of  the  aircraft.  In  a  memo 
to  USD(AT&L),  the  DOD  IG  recommended  that  the  EMD  aircraft  (7-10)  be  retrofitted 
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with  the  Lot  IV  fuel  tanks  prior  to  resuming  flight  testing.  The  System  Safety  Working 
Group  addressed  the  retrofit  of  qualified  fuel  tanks  into  all  aircraft.  Their  risk 
assessment  was  discussed  with  the  program  office  at  the  time  and  the  decision  was  made 
to  retrofit  the  fleet  aircraft,  but  not  the  EMD  aircraft.  This  decision  was  based  on  the 
limited  exposure  of  the  EMD  aircraft  compared  to  fleet  aircraft.  This  position  was 
reconfirmed  during  the  Return  to  Flight  (RTF)  and  Flight  Readiness  engineering  reviews. 


7.  Risk  Reduction  Alternatives: 

Option  1 :  Continue  to  conduct  EMD  flight  test  operations  with  non-compliant  sponson 
fuel  cells. 

System  Safety  Risk  Assessment  Code  is  ID  (Catastrophic,  Remote  Probability). 

Option  2:  Retrofit  a/c  with  sponson  fuel  tanks  that  are  fully  qualified  in  accordance  with 
the  requirements  of  MIL-T-27422B  and  MIL-STD429G.  The  residual  risk  will  remain  at 
a  ID  level  due  to  indeterminate  factors  associated  with  a  postcrash  environment.  This 
qualitative  classification  is  appropriate  given  the  programmatic  definition  of  D 
probability  risk  (Remote  -  Unlikely  but  possible  to  occur  in  the  life  of  an  item). 

The  current  program  plan  does  not  account  for  the  retrofit  of  the  Lot  IV  configuration 
qualified  fuel  tanks  into  the  EMD  aircraft.  The  EMD  aircraft  are  "hand  built'1  aircraft 
specifically  designed  to  conduct  flight-testing,  not  for  standard  fleet  operations  and  will 
not  be  transitioned  to  fleet  use.  EMD  aircraft  require  structural  modifications  to  support 
installation  of  fully  qualified  fuel  tanks.  Four  LRIP  aircraft  (21-24)  will  be  added  to  the 
DT  program.  The  existing  configuration  for  aircraft  21  and  22  passed  the  drop  test,  with 
the  exception  of  minor  leaking  from  the  single  aft  sponson  tank  { L5  oz  per  minute). 
Aircraft  23  and  24,  currently  at  Amarillo,  TX,  will  have  the  fuel  tanks  replaced  prior  to 
flight,  due  to  the  timing  and  availability  of  the  Lot  IV  tanks,  limited  modifications 
required  and  concurrent  rework  opportunities.  All  fleet  aircraft  will  be  equipped  with 
the  Lot  IV  fuel  tanks  as  part  of  the  Block  A  upgrade. 


S.  Potential  Consequences  of  Risk  Acceptance  Without  Action:  ID  Catastrophic,  unlikely  but 
possible  (Medium  Risk), 


9.  Contractor  Concurrence: 


PREPAREDBY: 

5/ti/cL 

_  DATE:  _ _ _ 

Michael  G.  Clemmons 
Boeing  Product  Safety  Manager 
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Appendix  K.  Initial  Analysis  of  V-22  System 

Safety  Risk  Assessment 


Our  initial  analysis  of  the  Navy’s  formal  system  safety  risk  assessment  of  the 
engineering  and  manufacturing  development  (EMD)  V-22  noncompliant  sponson 
fuel  cells  (Appendix  J)  and  our  concerns  about  that  risk  assessment  follow.  We 
conducted  the  analysis  on  May  29,  2002.  To  correlate  our  concerns,  we 
include,  as  applicable,  the  heading  from  the  system  safety  risk  assessment  in 
Appendix  J  and,  in  parentheses,  the  applicable  report  page  number. 


Navy  Risk  Assessment  Guidance 


Naval  Air  Systems  Command  Instruction  5100.11,  “Research  and  Engineering 
Technical  Review  of  Risk  Process  and  Procedures  for  Processing  Grounding 
Bulletins,”  September  3,  1999,  provides  guidance  on  engineering  technical 
review  of  risk  when  coordinating  an  engineering  recommendation  involving 
potential  grounding  of  aircraft.  The  Instruction  states  that  a  key  element  in 
understanding  and  managing  a  specific  hazard  is  a  risk  assessment  of  the 
potential  hazard.  The  risk  assessment  assigns  a  risk  level  to  the  hazard  and  is 
expressed  in  terms  related  to  the  operation  of  the  platform  or  system  in  question. 
The  risk  level  is  a  function  of  the: 

•  severity  of  the  hazard,  including  catastrophic,  critical,  marginal,  and 
negligible;  and 

•  frequency  of  occurrence  of  the  hazard,  including  frequent,  probable, 
occasional,  remote,  and  improbable. 

The  combination  of  those  two  factors  form  the  hazard  environment  that  must  be 
assessed.  Severity  is  expressed  in  terms  of  degree  of  injury,  property  damage, 
or  effect  on  mission.  Frequency  is  expressed  either  in  qualitative  terms,  such  as 
remote,  or  quantitative  terms,  such  as  probability  of  occurrence  or  failure  rate; 
for  example,  catastrophic-remote  or  ID.  Once  those  two  parameters  are 
defined,  a  system  safety  risk  analysis  matrix  is  used  to  identify  potentially 
unsafe  conditions.  The  resultant  four  risk  levels  in  the  matrix  are: 

•  unacceptable  or  a  high  safety  risk; 

•  undesirable  or  a  medium  safety  risk; 

•  acceptable  with  review  or  low  safety  risk;  and 

•  acceptable  without  review  or  very  low  safety  risk. 

Although  use  of  the  matrix  is  inherently  subjective,  the  process  accepts  data 
from  the  evaluation  of  inputs  supplied  by  flight  test  results,  original  equipment 
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manufacturers,  analysis,  and  laboratory  results  from  engineering  investigations. 
Often,  suitable  data  is  not  available  to  quantify  frequency  or  severity;  therefore, 
a  subjective  analysis  is  required.  In  those  cases,  the  matrix  still  provides  a 
consistent  framework  and  a  systematic  approach  for  assessing  and  managing 
risk. 


Concerns  With  V-22  EMD  System  Safety  Risk  Assessment 


Hazard  Classification.  (Page  32)  The  Navy  assigned  a  safety  risk  assessment 
code  of  ID  catastrophic-remote  (undesirable  or  a  medium  safety  risk)  for  the 
fuel  cells  installed  in  the  V-22  engineering  and  manufacturing  development 
(EMD)  test  aircraft.  The  next  higher  code  would  have  been  1C 
catastrophic-occasional  (unacceptable  or  high  safety  risk). 

Probability  of  a  Crash:  (2-10/100,000  flight  hours).  (Page  33)  The 
probability  factors  associated  with  a  crash  do  not  appear  to  be  reasonable.  The 
system  safety  risk  assessment  did  not  base  its  crash  frequency  probability  on 
past  performance  of  the  V-22  aircraft  or  other  EMD  aircraft.  Specifically: 

•  The  assessment’s  crash  frequency  probability  of  2  to  10  mishaps 
every  100,000  flight  hours  seems  inconsistent  with  the  number  of 
mishaps  experienced  and  the  technical  challenges  of  the  V-22. 
According  to  the  V-22  Program  Office,  the  V-22  has  experienced 
4  major  crashes  to  date  in  approximately  5,000  flight  hours. 

•  The  estimate  of  2  to  3  mishaps  in  100,000  flight  hours  was  based 
upon  historic  Class  A  helicopter  mishap  rates  for  the  Navy  and 
Marine  Corps.  However,  the  risk  assessment  codes  in  Naval  Air 
Systems  Command  Instruction  5100.11  are  based  on  the  risk  of 
aircraft  and  property  damage  and  personal  injury,  not  just  on 
“Class  A”  accidents  in  which  a  death  or  serious  injury  occurred. 

•  Crash  frequency  data  from  other  EMD  aircraft  would  have  been 
more  representative  than  crash  frequency  data  from  operational 
aircraft. 

•  In  making  its  probability  projections,  the  Navy  used  only  baseline 
probability  data  for  helicopters  and  not  baseline  probability  data  that 
considered  airplanes  as  well  as  helicopters.  Specifically,  the  V-22 
flies  like  an  airplane  and  takes  off  and  lands  like  a  helicopter;  but  the 
V-22  cannot  autorotate  and  land  in  the  event  of  an  engine  failure, 
according  to  the  Director,  Operational  Test  and  Evaluation  Report, 
“Combined  Operational  Test  and  Evaluation  and  Live  Fire  Test  and 
Evaluation  Report  on  the  V-22  Osprey,”  November  17,  2000. 
However,  the  V-22  Program  Office  indicated  that  the  V-22  has 
limited  ability  to  autorotate. 
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Qualitative  Considerations.  (Pages  32  and  33)  The  Navy  did  not  plan  to 
rigorously  test  the  V-22  EMD  test  aircraft  as  part  of  the  V-22  flight  test 
program.  The  system  safety  risk  assessment  stated  that: 

•  EMD  testing  will  be  conservative, 

•  EMD  aircraft  will  have  limited  exposure  compared  to  fleet  aircraft, 
and 

•  EMD  aircraft  will  not  be  transitioned  to  fleet  use. 

Because  EMD  testing  is  used  to  demonstrate  system  capabilities,  and  V-22  EMD 
test  aircraft  will  be  used  throughout  EMD  testing,  low-risk  testing  may  be 
incompatible  with  making  an  adequate  determination  of  the  aerodynamic 
characteristics  and  operational  limitations  of  the  V-22.  Further,  in  December 
2000,  the  Defense  Science  Board  criticized  the  V-22  Program  for  severely 
reducing  the  scope  of  developmental  testing. 

Data  Independence  and  Variability.  The  independence  and  variability  of 
probability  factors  used  in  the  system  safety  risk  assessment  are  questionable. 

•  Probability  That  a  Crash  Is  Survivable  and  Probability  That  the 
Crash  Occurs  Over  Land.  (Page  33)  Factors  in  the  hazardous 
probability  calculations  may  not  be  independent.  For  example,  the 
“probability  that  a  crash  is  survivable”  and  “probability  that  the 
crash  occurs  over  land”  may  be  dependent.  The  Navy  should  have 
considered  dependencies  among  factors  in  making  the  safety  risk 
level  determination. 

•  Probability  That  the  Fuel  Tank  Is  Compromised  During  a  Crash 
Condition.  (Pages  33  and  34)  Calculations  in  the  Navy’s  system 
safety  risk  assessment  addressed  the  variability  in  the  number  of 
crashes.  However,  the  variability  of  other  factors,  such  as  the 
“probability  that  the  fuel  tank  is  compromised  during  a  crash 
condition,”  was  not  addressed  in  the  risk  assessment. 

Conclusion.  If  the  crash  frequency  probability  was  based  on  the  past 
performance  of  either  the  V-22  or  fixed-wing  EMD  aircraft,  which  the  Navy  did 
provide,  and  the  system  safety  risk  assessment  model  was  adjusted  to  account 
for  the  nonindependence  between  the  “probability  that  the  crash  occurs  over 
land”  and  the  “probability  that  a  crash  is  survivable,”  the  safety  risk  assessment 
code  would  increase  from  undesirable  or  a  medium  safety  risk  to  unacceptable 
or  high  safety  risk.  Accordingly,  we  have  concerns  with  the  methodology, 
reasonableness,  and  support  of  the  probability  factors  used  in  the  system  safety 
risk  assessment  for  the  noncompliant  sponson  fuel  cells  on  the  V-22  EMD 
aircraft. 
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Appendix  L.  Office  of  the  Inspector  General  of  the 
Department  of  Defense  Memorandum 

Concerning  Safety  of  V-22  Aircraft 


INSPECTOR  GENERAL 
DEPARTMENT  OF  DEFENSE 
400  ARMY  NAVY  DRIVE 
ARLINGTON,  VIRGINIA  22302-4704 


UN  T  2002 


MEMORANDUM  FOR  UNDER  SECRETARY  OF  DEFENSE  FOR  ACQUISITION, 
TECHNOLOGY,  AND  LOGISTICS 


SUBJECT;  Safety  of  the  V-22  Osprey  Joint  Advanced  Vertical  Aircraft  (Project 
No.  D20Q2AE-0065) 


This  memorandum  is  in  response  to  your  May  28,  2002,  memorandum  that  endorsed 
the  Navy’s  May  24,  2002,  System  Safety  Formal  Risk  Assessment  on  the  engineering  and 
manufacturing  development  (EMD)  V-22  noncomp li ant  sponson  fuel  cells  as  a  response 
to  a  draft  audit  recommendation.  Because  of  a  new  issue  that  the  Navy's  Risk  Assessment  has 
raised,  we  are  unable  to  audit  and  validate  the  reasonableness  of  the  Risk  Assessment. 

The  Navy's  System  Safety  Formal  Risk  Assessment  purported  to  determine  that 
the  risk  of  flying  V-22  EMD  aircraft  with  noncomp  I  i  ant  fuel  cells  should  be  categorized  as 
“ID  Catastrophic,  unlikely  but  possible  (Medium  Risk).”  The  Risk  Assessment  does  not  appear 
to  have  taken  into  consideration  the  unique  nature  of  the  EMD  testing  and  the  EMD  test  aircraft, 
which  raises  fundamental  questions  concerning  the  evaluation  methodology  used.  At  least  one 
key  factor  appears  to  be  based  on  data  from  operational  aircraft,  which  appears  to  be  a  significant 
methodological  error. 

We  plan  to  issue  another  draft  report  that  details  concerns  associated  with  the  safety 
risk  assessment  of  the  fuel  cells  installed  in  the  V-22  EMD  test  aircraft  and  that  requests 
comments  on  new  recommendations.  Also,  we  intend  to  include  the  May  24,  2002,  safety 
risk  assessment  in  the  draft  report  and  will  ask  the  Navy  to  correct  an  error  in  the  introductory 
“scrivener  notes”  to  the  assessment. 


Director  of  Operational  Test  and  Evaluation 
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Appendix  M.  Navy  Response  to  Questions  on  the 

System  Safety  Risk  Assessment  for 
V-22  Fuel  Cells 


Questions  Concerning  the  Safety  Assessment  for  the  V-22  Engineering 
and  Manufacturing  Development  Fuel  Cells 

USD(AT&L)  Flight  Decision  Documents. 

L  Provide  a  copy  of  the  sponson  fuel  ceil  SAR  report  to  include  all  entries  made  as  of  May  6, 
2002  (SAR  report  cut  off  date),  and  all  entries  as  of  date  this  Email  was  received. 

This  document  is  proprietary  to  Bell-Boeing.  It  will  be  forwarded  by  separate  correspondence 
when  it  has  been  approved  for  release  by  Bell- Boeing. 

2,  Provide  Flight  Readiness  Review,  March  21,  2002,  briefings,  results  and  any  other 
documentation  available  used  to  support  the  review  or  to  record  the  review  results.  Provide  a  list 
of  review  attendees.  Also  include  any  documentation  or  assessments  to  support  the  contention 
that  the  safety  of  the  EMD  aircraft  sponson  fuel  cells  was  addressed. 

The  discussion  at  the  FRR  concerning  the  safety  of  the  EMD  aircraft  with  respect  to  non¬ 
comp  li ant  fuel  cells  was  not  documented.  RDML  Heely  personally  briefed  VADM  Dyer  and 
LTGEN  Reynolds  concerning  the  risks  associated  with  the  fuel  cells,  VADM  Dyer  and  LTGEN 
Reynolds  concurred  with  the  assessment  as  briefed  and  no  further  discussion  was  required. 

Safety  Assessment  Data  and  Methodology. 

3.  Was  actual  V-22  crash  history  and/or  developmental  aircraft  accident  history  factored  into  the 
“probability  of  a  crash15  factor?  If  yes,  how  was  it  done?  If  no,  please  explain  why  not? 

No,  this  risk  assessment  attempts  to  take  into  account  a  "reasonable"  worst  case  (10  per  100K 
flight  hours  for  mishap  rate  -  1  every  1 0,000  flight  hours  -  probable).  The  EMD  aircraft  have 
flown  nearly  2000  hours  without  a  mishap.  It  must  be  noted,  the  FRR  concurred  that  the 
expected  level  of  risk  for  the  V-22  return  to  flight  for  EMD  to  be  medium.  This  was  based  on  all 
the  efforts  conducted  over  the  14  month  down  period  to  assess  and  improve  overall  safety. 

Below  find  an  explanation  of  the  crash  history  and  rationale: 

V-22  has  experienced  4  Class  A  mishaps: 

FSD  DT  testing  -  1 184  flight  hours.  2  mishaps.  A/C  5  and  A/C  4 

EMD  DT  testing  -  1894  flight  hours.  0  mishaps 

LRIP  -  1869  flight  hours.  2  mishaps.  A/C  14  and  A/C  18 

A/C  5  mishap  occurred  in  1991,  Aircrcw/occupants  aboard  aircraft  #5  survived  with  minimal 
injuries.  The  crash  occurred  on  the  A/Cs  maiden  flight  and  was  the  result  of  flawed  assembly 
processes  (The  impact  forces  were  survivable). 

A/C  4  mishap  was  the  result  of  a  design  deficiency  that  allowed  fluid  to  pool  in  a  nacelle  inlet 
and  be  ingested  by  an  engine  following  conversion.  An  engine  surge  resulted  and  the  back 
pressure  failed  the  inlet.  A  fire  propagation  path  to  the  upper  nacelle  resulted  in  fire 
impingement  on  the  pylon  driveshaft,  The  shaft  subsequently  failed  resulting  in  asymmetric 
thrust  (The  impact  forces  were  not  survivable) 
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A/C  14  mishap  occurred  when  the  pilot  exceeded  the  flight  clearance.  As  a  result,  the  a/c 
entered  into  vortex  ring  state  and  an  asymmetric  thrust  condition  {The  impact  forces  were  not 
survivable). 

A/C  IS  mishap  chain  of  events  are  as  follows.  Hydraulic  leak  followed  by  multiple  PFCS  resets. 
The  rotor  governor  re-initialization  logic  resulted  in  large  pitch  changes  at  the  blades.  All  three 
actuators  in  one  nacelle  were  rate  limited  due  to  the  initial  hydraulic  leak.  Multiple  PFCS  resets 
eventually  put  the  a/c  in  an  unrecoverable  yaw/wing  stall  state  (The  impact  forces  were  not 
survivable). 

Each  development  aircraft  is  different . varying  requirements,  varying  levels  of  accepted  risks, 

and  different  configurations.  Developmental  aircraft,  in  general,  have  very  few  flight  hours 
compared  to  the  number  of  flight  hours  the  aircraft  accumulates  during  deployment.  As  such, 
"Mishap  Rales"  are  generally  higher  than  compared  to  aircraft  which  are  flying  in  the  fleet  (i.e. 
rates  for  DT/OT  testing  phases:  F-14A  -  79/100,000;  F-16A  -  50/100,000;  F-J  SA/B  - 
61/100,000).  Due  to  the  various  differences  between  development  aircraft  (as  mentioned  earlier) 
usage  of  this  mishap  rate  would  not  be  reflective  of  one  specific  airframe  in  developmcnt/flight 
test  phase.  Using  mishap  rates  incurred  on  like  aircraft  in  the  fleet  that  have  accumulated 
significant  flight  hours  combined  with  the  use  of  conservative  factors  provides  a  more  "realistic" 
assessment.  Risk  assessments  are  a  tool  to  evaluate  risk  using  relevant  data  when  available 
(readily  within  reason).  Qualitative  factors  (judgement  call  sometimes  based  on  common  sense 
and  lessons  learned)  are  sometime  the  only  way  to  induce  realism  in  the  risk  projection.  Mil- 
Std-882  provides  the  following  guidance  in  terms  of  mishap  probability:  n Assigning  a 
quantitative  mishap  probability  to  a  potential  design  or  procedural  hazard  is  generally  not 
possible  early  in  the  design  process.  At  that  stage r  qualitative  mishap  probability  may  be 
derived  from  research,  analysis p  and  evaluation  of  historical  safety  data  from  similar  systems 

4,  Because  the  V-22  configuration  and  capabilities  are  unique,  please  explain  why  you  used 
historical  helicopter  survivability  experience  when  establishing  the  “probability  that  a  [V~22] 
crash  i  s  survi  vabl e”  rather  than  historical  ai  rp  lane  surv  i vability  experience? 

The  V-22,  as  a  tilt-rotor  aircraft  incorporates  crashworthy  features  in  critical  subsystems; 

Landing  Gear,  Structure  (includes  soft  soil  impact,  wing  failure  modes  and  blade  strike 
assessments),  Crew  Seats,  Troop  and  auxiliary  seats.  Cargo  restraint,  Crew  injurious 
environment.  Emergency  egress.  Water  ditching  and  post-ditching  flotation,  fuel  system. 
Transport  fixed  wing  aircraft  are  not  designed  to  the  same  stringent  (Mil -Sid- 1 290  -  light  fixed 
and  rotary  wing  aircraft  crashworthiness)  requirements  that  have  been  imposed  on  the  V-22  and 
are  imposed  on  all  new  light  fixed  and  rotary  wing  military  aircraft  platforms.  High- 
performance,  fixed  wing  aircraft  are  equipped  with  ejection  seats  and  do  not  share  the  same 
crashworthiness  features  nor  do  they  operate  in  the  same  environment.  Similarly,  large  multi- 
engine  transport  aircraft,  do  not  employ  the  same  crashworthiness  features  (such  as  energy 
attenuating  landing  gear  and  seating)  and  rely  more  heavily  on  large  fuselage  deformation  for 
energy  attenuation.  It  is  therefore  deemed  appropriate  to  make  this  comparison. 

5,  What  was  the  source  of  the  helicopter  data  used  for  the  safety  assessment,  what  was  the 
population  and  population  size  the  data  was  developed  from,  and  what  timeframe  does  the  data 
represent?  Did  the  data  include  helicopters  without  the  capability  to  make  an  autorotation 
landing  in  the  event  of  engine  failure?  Please  provide  a  copy  of  the  data  used.  (NOTE;  We 
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attempted  to  view  the  website  source  referenced  in  the  risk  assessment,  but  were  unable  to 
determine  the  exact  link  you  used.) 

*  Autorotations  are  performed  in  response  to  either  total  power  loss  (requires  dual  engine 
failures  in  all  Navy/Marine  Corp  helicopters,  including  V-22)  or  due  to  tail  rotor  failures  (for 
conventional  helicopters).  The  vast  majority  of  autorotations  are  due  to  tail  rotor  failures.  Lack 
of  tail-rotor  will  reduce  the  need  for  V-22  autorotation  capability  (compared  to  single  rotor 
helicopters).  The  probability  of  having  to  conduct  an  automation  is  considered  improbable. 

The  data  source  for  mishap  rate  is  provided  below: 


Naval  Safety  Center  Data 


The  following  additional  data  sources  support  this  assessment: 

Source  1:  V-22  Crashworthiness  Presentation  Summary  3  Boeing  Vertol  Company  6  May  1986* 

Source  2:  The  Naval  Aircraft  Accident  Environment,  Phase  I,  Helicopter  Aircrew  Survivability 
and  Structural  Response,  Prepared  by,  Joseph  W.  Coltman,  Simula  Lnc.  1984. 

Source  3:  Interim  Reports  1-2.  I  -  Analysis  of  Navy/Marine  Corps  Helicopter  mishaps, 

2-  Terrain  Characteristics  in  Navy/Marine  Coips  Helicopter  mishaps,  prepared  by 
KETRON  Division  of  the  Bionetics  Corporation  for  the  Naval  Air  Warfare  Center 
Aircraft  Division  Code  4,6.2. 1,  September  1998. 

Source  4  :  Data  from  Naval  Safety  Center, 

6.  What  was  the  source  for  the  data  used  to  develop  the  “probability  that  a  crash  is  survivable" 
factor,  what  was  the  population  and  population  size  the  data  was  developed  from,  and  what 
timeframe  does  the  data  represent.  Why  was  only  class  A  mishaps  represented  by  this  factor? 
Please  provide  a  copy  of  the  data  used. 

Source  2  data  -  Helicopter  Flight  Mishap  Analysis  (CY  1972  '1981),  Sample  size  was  184 
mishaps.  53  events  considered  low  severity  impacts*  -  No  injury  to  occupant  (Note:  A  Class  A 
Mishap  is  one  in  which  damage  costs  exceeded  1  million  dollars  (or  fatalities/permanent 
disability).  Class  B  and  C  mishaps  include  those  involving  a  smaller  dollar  amount.  Class  B  and 
C  mishaps  are  not  typically  classified  as  crashes),  101  events  considered  significantly  survivable 
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mishaps.  -  Flight  mishap  resulting  in  at  least  substantial  structural  damage  and  one  or  more  major 
injuries  to  the  occupants,  30  events  considered  non-survivable  mishaps.  -  The  impact 
acceleration  environment  exceeded  the  limits  of  human  tolerance,  and/or  the  occupied  volume 
was  compromised.  Eliminating  the  54,  low  severity  impact  events  (hard  landing  events)  results 
in  a  non-survivability  rate  of  30  non-survivable /1 3 1  total  events  =  23% 

Source  3  data  -  used  class  A  mishap  data  from  1980  to  1997.  This  data  indicates  that  out  of  284 
mishaps,  208  were  categorized  as  Survivable  or  Partially  Survivable  {Some  portion  of  the 
airframe  maintained  enough  occupiable  volume  to  allow  for  occupant  survival  -  usually  involves 
some  occupant  deaths  and  some  occupant  injuries),  76  of  the  mishaps  were  considered  Non- 
Survivable  ( 27%  non-survivable). 

The  assessment  assumed  that  the  survivability  rate  was  50%, 

If  the  assessment  were  adjusted  to  reflect  a  survivability  rate  of  75%,  the  risk  level  for  the 
hazardous  condition  would  be: 

before:  2  X  ,5  X  ,5  X  ,5  X  l  x,5  =  .  125  events  per  hundred  thousand  flight  hrs,  =  D  (Remote) 

10  x  ,5  x  .5  x  .5  x  1  x  .5  =  .625  events  per  hundred  thousand  flight  hrs.  =  D  (Remote) 

after:  2  x  .75  x  .5  x  ,5  x  1  x  ,5  =  .1875  events  per  hundred  thousand  flight  hrs,  =  D  (Remote) 
10  x  ,75  x  .5  x,5x  1  x  ,5  =  ,94  events  per  hundred  thousand  flight  hrs.  =  D  (Remote) 

7.  What  was  the  source  for  the  data  that  was  used  to  develop  the  “probability  that  a  crash  occurs 
over  land”  factor,  what  was  the  population  and  population  size  the  data  was  developed  from,  and 
what  timeframe  does  the  data  represent?  Please  provide  a  copy  of  the  data  used. 

The  V-22  is  a  replacement  for  the  H -46,  The  data  below  fully  supports  the  50%  over  land  statement. 

H-46  Data:  Source  1  data  source  shows  31/66  =  47%  water  crashes.  Source  2  data  57%  water 
crashes.  Source  4  data  shows  32/52  or  62%  water  crashes. 

Source  3  data  indicates  that  for  all  Navy/Marine  Corps  Helicopters,  157/284  or  55%  of  all  crashes 
occurred  into  the  water 


Source  1 

H-46  CLASS  A  MISHAPS 


Source  2 

Population  size:  184  mishaps 


Source  4  data: 


NAVAL  SAFETY  CENTER 
AIRCRAFT  MISHAP  LOCATION  SUMMARY 
(01  OCT  1985- 10  JUN  2002} 
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Source  3  data  indicates  that  157  of  2S4  (55%)  mishaps  occurred  over  water  for  all  helos, 

8.  Please  provide  evidence  that  the  factors  “probability  that  a  crash  is  survivable”  and 
“probability  that  a  crash  occurs  over  land”  are  actually  mathematically  independent  factors* 

Data  is  not  currently  available  to  state  that  the  probabilities  are  totally  independent.  There  may 
be  some  degree  of  statistical  dependence  but  that  degree  is  unknown.  In  the  V-22  mishaps,  there 
were  3  land  crashes  and  1  was  survivable.  Fuel  cell  crashworthiness  would  not  have  been  a 
factor  in  3  out  of  the  4  mishaps  (75%)  -  impact  loads  far  exceeded  survivable  mishap  threshold 
(human  thresholds). 

Source  4  data  indicates  that: 

32  of  the  157  water  mishaps  (or  20%  of  water  mishaps  were  considered  non-survivable). 

44  out  of  127  land  mishaps  (or  35%  of  land  mishaps  were  considered  non-survivable), 

9.  What  was  the  source  for  the  data  that  was  used  to  develop  the  “probability  that  the  fuel  tank  is 
compromised  during  a  crash  condition”  factor  and  what  was  the  population  and  population  size 
the  data  was  developed  from,  and  what  timeframe  does  the  data  represent?  Please  provide  a 
copy  of  the  data  used.  You  use  a  “probability  that  the  fuel  tank  is  compromised  during  a  crash 
condition”  factor  of  50  percent,  what  would  be  the  factor  for  sponson  fiiel  cells  that  met  the 
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EMD  aircraft  specification,  and  how  did  you  adjust  that  factor  to  address  noncompliant  fuel 
cells? 

A  fully  compliant  tank  may  be  compromised  on  the  order  of  10-20%  based  on  the  data  presented  and 
discussed  below.  The  50  percent  factor  addresses  the  fact  that  the  tank  is  not  fully  compliant  tank.  The 
probability  that  an  extensible  tank  is  compromised  will  be  a  function  of  the  magnitude  of  the  crash.  The 
V-22  landing  gear  is  capable  of  attenuating  impact  velocities  up  to  24  ft/sec.  The  function  of  the  landing 
gear  system  in  a  crash  situation  is  to  provide  controlled  loading  and  energy  attenuation.  Deceleration 
loads  experienced  by  the  extensible  tanks  during  a  24  ft/sec  crash  are  not  anticipated  to  compromise  the 
integrity  of  the  tank,  Impacts  beyond  24  ft/sec  could  impart  significant  loading  to  the  extensible  fuel 
cells.  It  is  therefore  conservatively  assumed  that  fuel  leakage  will  occur  for  impact  velocities  above  24 
ft/sec.  It  is  also  assumed  (and  historically  supported)  that  approximately  50%  of  the  survivable  mishaps 
will  have  an  impact  velocity  of  greater  than  24  ft/sec. 

The  data  provided  below  refers  to  ,f survivable  crashes'1  and  suggests  that  only  about  30%  (vs.  the  50% 
used  in  the  calculations)  of  the  survivable  mishaps  occur  with  vertical  velocities  of  above  24  fi/sec. 
Below  24  ft/sec,  the  deceleration  is  controlled  by  the  landing  gear.  Beyond  24  ft/sec,  the  deceleration  is 
controlled  by  fuselage  deformation  and  is  somewhat  unpredictable.  This  does  not  mean  that  the  tank  will 
fail.  The  assumption  that  the  tank  will  fail  is  conservative  and  the  percentage  of  survivable  mishaps  with 
vertical  impact  velocities  greater  than  24  ft/sec  is  also  conservative.  A/C  5  mishap  was  a  survivable 
crash.  All  onboard  fuel  at  the  time  of  the  mishap  was  recovered  from  the  sponson  tanks. 

Source  2  Data  :  The  Naval  Aircraft  Accident  Environment,  Phase  I,  Helicopter  Aircrew 
Survivability  and  Structural  Response,  Prepared  by,  Joseph  W.  Coltman,  Simula  Inc.  1984. 

vertical  vaocrrv  change 

HELICOPTER  LAND  ACCIDENTS 


VERTICAL  VELOCITY  CHANGE  -  FT/3EQ 


10,  Is  there  any  data  available  to  be  used  as  a  basis  to  support  the  assumption  used  for  the 
“probability  that  an  ignition  source  is  present  following  a  post  crash  fuel  spill”  factor?  If  there  is 
no  data  available  to  be  used  as  a  basis  for  this  assumption,  please  explain  the  basis  you  used  for 
the  assumption. 

The  100%  assumption  is  ultra  conservative.  When  lacking  data.  System  Safety  tends  to  side 
towards  being  conservative.  Again,  below  24 ft/sec,  the  crash  sequence  is  controlled.  At 
fuselage  separation/deformation  points,  self-sealing  breakaway  valves  are  provided.  It  is  safe  to 
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say  that  some  crashes  beyond  24  ft/sec  will  not  produce  an  ignition  source  of  sufficient  energy  to 
ignite  a  fuel  source  (the  engines  which  are  considered  the  primary  hot  surface  ignition  source  arc 
at  the  wing  tips  and  are  not  located  near  the  fuselage  &  sponson  tanks). 

11.  Is  there  any  data  available  to  be  used  as  a  basis  to  support  the  assumption  used  for  the 
"■probability  that  occupants  arc  not  able  to  egress  the  aircraft  during  a  post  crash  fire”  factor?  If 
there  is  no  data  available  to  be  used  as  a  basis  for  this  assumption,  please  explain  the  basis  you 
used  for  the  assumption. 

Assumption  is  viewed  as  reasonable  given  the  number  of  aircraft  egress  points  (7)  and  the  fact 
that  flight  test  operations  will  be  limited  to  minimum  essential  crew.  This  should  extend  time 
allowed  for  egress  in  the  event  that  the  engines  are  the  ignition  source.  A/C  5  experienced  a 
post-crash  fire  and  the  crew  had  adequate  time  to  egress  the  a/c.  The  Naval  Safety  Center 
supported  this  figure. 

Source  4  data  request  was  made  subsequent  to  initial  submittal  of  the  Safety  Assessment  report 
to  verify  the  assumption  regarding  post-crash  fire  egress.  A  data  query  was  set  up  to  look  at 
class  A  and  B  helicopter  mishaps  from  the  1985  to  2002,  The  data  looked  mishaps  involving  a 
post-crash  fire,  occupant  injury  type  {not  cause)  and  egress  method. 

37  events  were  identified  involving  236  occupants 

109  occupants  were  killed  -  Cause  of  death  is  not  provided  (crash  impact  vs.  post  crash  fire) 

127  occupants  survived  both  the  impact  and  the  post-crash  fire. 

If  we  assume  that  all  109  occupant  fatalities  were  the  result  of  post-crash  fire  related  factors  (this 
is  a  conservative  assumption),  the  data  indicates  that  127  out  of  236  or  53%  of  occupants  were 
able  to  egress  the  a/c  and  were  not  killed  by  the  post-crash  fire. 

An  example  of  an  a/c  that  experienced  a  post-crash  fire  in  which  the  occupants  had  adequate 
time  to  egress  the  a/c  is  provided  below: 

Acft  crashed  into  ground  during  takeoff 

Ac  ft  impacted  ground  during  takeoff  &  was  destroyed  by  post-crash  fire.  Aircrew 
Safely  egressed.  Following  landing  for  3rd  hot  refuel  in  desert  environment  helicopter  aircraft 
commander  again  placed  nr  l  &  nr  3  eng  speed  control  levers  in  ground  idle  position  to 
prevent  nose  gearbox  overtemp.  After  refueling,  copilot,  following  section  leader, 
began  downwind  running  takeoff  on  short  end  of  runway  concentrating  on  lineup. 

Aircraft  lifted  10-15  ft  in  ground  effect  but  approaching  end  of  runway  began  to  settle 
back  towards  ground.  Helicopter  Aircraft  Commander  took  control  of  aircraft.  Copilot  placed 
hand  on  speed  control  levers  &  realized  only  l  engine  lever  was  advanced  &  moved  all  3  levers 
to  Full  power.  Helicopter  Aircraft  Commander  initiated  flair  at  low  altitude.  Tail  skid  struck 
ground  &  Copilot  pulled  all  engines  back  to  idle.  Mishap  Aircraft  hit  ground  on  nose  landing 
410  ft  from  departure  end  of  runway,  lifted  up  &  flipped  right,  landing  upside  down  on  rotor 
Head.  Fire  damage  resulted  when  left  sponson  fuel  tank  Tuplured  pouring  fuel  on 
Nr  1  eng. 

12.  Have  you  performed  and  documented  other  system  safety  risk  assessments  for  the  V-22 
program?  If  you  have  performed  and  documented  other  system  safety  risk  assessments,  please 
provide  a  few  examples. 
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Yes,  System  Safety  has  performed  approximately  50  formal  risk  assessments  over  the  past  5 
years.  Two  examples  are: 

Cross  Channel  Data  Link  Failures,  FRA-2002-G1,  Jan  02 
Rudder  Actuator  Binding,  FRA-2002-03,  Dec  01 


13.  Why  doesn't  the  model  consider  a  range  (sensitivity)  of  factor  probabilities  for  the 
"probability  that  occupants  are  not  able  to  egress  the  aircraft  during  a  post  crash  fire”  factor, 
t£probability  that  an  ignition  source  is  present  following  a  post  crash  fuel  spill”  factor, 
probability  that  the  fuel  tank  is  compromised  during  a  crash  condition”  factor,  “probability  that 
a  crash  occurs  over  land”  factor,  and  the  “probability  that  a  crash  is  survivable"  factor? 

The  approach  used  in  this  risk  assessment  is  typical  of  any  analysis  conducted  by  System  Safety. 
The  qualitative  assessment  is  used  in  conjunction  with  the  quantitative  assessment  (if  sufficient 
applicable  data  is  available  to  support  such  analysis)  to  develop  a  Risk  Assessment.  It  is  the 
combination  of  qualitative  and  quantitative  analyses  that  determines  Risk  (we  do  not  look  strictly 
at  historical  data  and/or  reliability  numbers  when  assessing  Risk).  If  the  assumptions  are 
conservative  then  there  should  not  be  a  need  for  a  sensitivity  analysis.  Again,  quantitative 
analysis  is  never  the  end  all  when  it  comes  to  determining  risk. 

V-22  Test  Program. 

14.  Provide  the  planned  V-22  developmental  test  and  operational  test  program  and  schedule  to 
include  number  of  planned  flight  hours. 

Estimated  planned  (developmental  test)  flight  hrs. 

A/C  S  -  54S 
A/C  10  -560 

A/C  7&9  combined  -  1429  hrs 
Total  -  2537  flight  hours 

15.  Will  the  EMD  aircraft  be  used  for  the  operational  test  and  evaluation? 

No  -  A/C  34  will  be  the  first  OT&E  A/C  and  it  will  have  the  Block  A  fuel  cells,  non-ex  tensible 
tanks,  that  have  fully  passed  qualification  testing.  OT  pilots  will  participate  in  the  EMD 
program,  but  dedicated  OT&E  will  not  be  conducted  with  EMD  aircraft. 

16.  How  long  would  the  V-22  developmental  test  and  operational  test  program  schedule  be 
delayed  if  compliant  fuel  cells  were  installed  in  the  EMD  aircraft? 

A  six  to  eight  week  delay  per  aircraft  is  expected  once  all  material  has  been  received. 

17.  Provide  a  copy  of  the  waiver  for  the  acceptance  of  the  EMD  aircraft  installation  of 
noncompliant  sponson  fuel  cells. 

There  is  no  waiver  related  to  fuel  cells  for  the  EMD  aircraft.  These  aircraft  were  never  officially 
bought  by  the  government  (DD250).  The  configuration  control  is  maintained  by  Bell-Boeing, 
with  DCMA  and  NAVAIR  oversight  for  Flight  Clearances  and  Airworthiness  Certification, 

IS.  Has  the  sponson  fuel  cel!  qualification  test  report  (for  the  EFC  manufactured  cells)  been 
reviewed  and  approved  by  the  Fuel  IPT?  If  not,  why  not,  and  when  will  the  test  report  be 
reviewed  and  approved? 
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Yes,  it  has  been  reviewed  and  approved 

19.  How  do  you  reconcile  the  system  safely  risk  assessment  contention  that  the  EMD  aircraft 
testing  will  be  conservative,  and  the  EMD  aircraft  will  have  limited  exposure  compared  to  fleet 
aircraft  resulting  in  low  risk  EMD  aircraft  flights,  with  a  testing  program  that  requires  testers  to 
adequately  validate  the  aircraft  design  improvements  and  determine  the  aerodynamic 
characteristics  and  operational  limitations  of  the  V-22  aircraft? 

EMD  flight  testing  is  conducted  in  a  controlled  environment  with  substantial  build- 
up/prerequisite  testing  and  planning*  Flight  test  plans  are  routed  across  a  broad  expanse  of 
engineering  competencies  and  must  move  past  several  layers  of  approval  authority  before  flight 
test  crews  can  even  man  up  developmental  aircraft  for  flight  testing.  Before  flight  test  plans  get 
to  the  final  review  stage,  they  can  be  subject  to  the  equivalent  of  hundreds  of  years  of  flight  test 
and  risk  management  experience.  Risks  are  carefully  considered  and  mitigated  to  the  greatest 
degree  possible. 

Instrumentation  provides  data  in  the  form  of  real  time  telemetry  to  the  flight  test  team  for  the  a/c 
that  arc  conducting  envelope  expansion  testing.  Aircraft  response  and  airworthiness  is  very  often 
observed  real-time  by  flight  test  engineers,  who  then  communicate  with  lest  crews  to  provide 
them  a  magnitude  of  situational  awareness  and  wealth  of  professional  knowledge  that  is  not 
available  to  the  fleet  pilot.  It  is  rather  routine,  to  have  a  flight  test  engineer  immediately  abort  a 
flight  when  an  aircraft  limit  exceedence  is  experienced  -  limiting  exposure  of  a  flight  test  crew  to 
an  unsafe  condition.  In  contrast,  the  fleet  operational  pilots  do  not  operate  in  this  relatively 
pristine  environment  and  arc  not  subject  to  the  oversight  mandated  by  the  Integrated  Test  Team. 
There  is  much  more  room  for  human/operator  error  in  the  fleet. 

Within  flight  test  organizations,  maintenance  intervals  are  much  more  frequent  than  would  be 
seen  for  a  fleet  aircraft.  The  amount  of  oversight  and  scrutiny  placed  upon  daily  aircraft 
operations  is  an  order  of  magnitude  beyond  what  would  be  typical  of  fleet  operations. 


Points  of  Contact  in  PMA-275,  Col.  Paul  Croisetiere,  Weapons  System  Integrator  (301)  757- 
5576,  or  Cdr.  Tim  Dunigan,  V-22  Class  Desk  (301)  757-5541 , 
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Appendix  N.  Analysis  of  the  Navy  Response  to 

Issues  With  the  System  Safety  Risk 
Assessment  for  V-22  Fuel  Cells 


The  V-22  Program  Office  provided  comments  in  response  to  issues  we  had  with 
the  System  Safety  Risk  Assessment  for  the  V-22  fuel  cells  (Appendix  M).  The 
issues  include  the  USD(AT&L)  flight  decision  documents,  safety  assessment 
data  and  methodology,  and  the  V-22  test  program.  The  following  discusses 
those  issues  by  number;  the  Navy’s  response;  and  the  audit  response,  as 
applicable. 


USD(AT&L)  Flight  Decision  Documents 

1.  Provide  a  copy  of  the  sponson  fuel  cell  SAR  [safety  action  record]  report 
to  include  all  entries  made  as  of  May  6,  2002  (SAR  report  cut  off  date),  and 
all  entries  as  of  date  this  Email  was  received. 

Navy  Response.  The  V-22  Program  Office  stated  that  the  safety  action  record 
for  the  V-22  sponson  fuel  cell  is  proprietary  to  Bell-Boeing  and  will  be 
forwarded  by  separate  correspondence  when  Bell-Boeing  has  approved  it  for 
release. 

Audit  Response.  On  July  22,  2002,  we  received  the  safety  action  record.  The 
safety  action  record  did  not  document  and  support  the  basis  for  assessing  the 
safety  risk  as  “ID  (medium)  risk”  (undesirable  risk)  rather  than  “high  risk” 
(unacceptable  risk),  the  next  higher  level  of  safety  risk. 

2.  Provide  Flight  Readiness  Review,  March  21,  2002,  briefings,  results  and 
any  other  documentation  available  used  to  support  the  review  or  to  record 
the  review  results.  Provide  a  list  of  review  attendees.  Also  include  any 
documentation  or  assessments  to  support  the  contention  that  the  safety  of 
the  EMD  [engineering  and  manufacturing  development]  aircraft  sponson 
fuel  cells  was  addressed. 

Navy  Response.  The  V-22  Program  Office  stated  that  nobody  documented  the 
discussion  at  the  March  21,  2002,  Flight  Readiness  Review  concerning  the 
safety  of  the  EMD  aircraft  with  respect  to  the  noncompliant  fuel  cells. 

However,  the  V-22  Program  Office  stated  that  Rear  Admiral  Heely,  Assistant 
Commander,  Naval  Air  Systems  Command  for  Research  and  Engineering, 
personally  briefed  Vice  Admiral  Dyer,  Commander,  Naval  Air  Systems 
Command;  and  Lieutenant  General  Reynolds,  Commander,  Aeronautical 
Systems  Center,  Air  Force  Materiel  Command,  concerning  the  risks  associated 
with  the  fuel  cells.  Vice  Admiral  Dyer  and  Lieutenant  General  Reynolds 
concurred  with  the  assessment,  as  briefed,  and  no  further  discussion  was 
required. 
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Audit  Response.  In  his  May  28,  2002,  memorandum,  the  USD(AT&L)  stated 
that  the  Navy  specifically  addressed  the  fuel  cell  issue  at  a  Flight  Readiness 
Review  on  March  21,  2002.  However,  without  documentation  from  the  Flight 
Readiness  Review,  we  cannot  verify  from  an  audit  perspective  that  the  safety  of 
the  EMD  aircraft  sponson  fuel  cells  was  specifically  addressed  at  the  review. 


Safety  Assessment  Data  and  Methodology 

3.  Was  actual  V-22  crash  history  and/or  developmental  aircraft  accident 
history  factored  into  the  “probability  of  a  crash”  factor?  If  yes,  how  was  it 
done?  If  no,  please  explain  why  not? 

Navy  Response.  The  V-22  Program  Office  response  addressed  the  probability 
of  a  crash  and  aircraft  mishap  rates. 

Probability  of  a  Crash.  The  V-22  Program  Office  stated  that  actual 
V-22  crash  history  and  developmental  aircraft  accident  history  were  not  factored 
into  the  “probability  of  a  crash”  factor  because  the  risk  assessment  attempts  to 
take  into  account  a  “reasonable”  worst  case  of  10  mishaps  per  100,000  flight 
hours  or  1  mishap  every  10,000  flight  hours.  Further,  the  Program  Office 
stated  that  the  EMD  aircraft  have  flown  nearly  2,000  hours  without  a  mishap 
and  noted  that  the  Flight  Readiness  Review  concurred  that  the  expected  level  of 
risk  for  the  V-22  EMD  test  aircraft  returning  to  flight  was  medium.  The 
Program  Office  also  stated  that  the  medium  level  of  risk  was  based  on  the 
efforts  conducted  over  the  14-month  down  period  to  assess  and  improve  overall 
safety. 


Aircraft  Mishap  Rates.  The  V-22  Program  Office  stated  that  the  V-22 
aircraft  have  flown  a  total  of  4,947  hours  during  full-scale  development,  EMD, 
and  low-rate  initial  production  developmental  aircraft  testing  and  have 
experienced  four  Class  A  mishaps  as  follows: 

•  for  1,184  flight  hours  of  full-scale  development  aircraft 
testing,  the  V-22  experienced  two  mishaps  involving 
Aircraft  Build  Nos.  4  and  5; 

•  for  1,894  flight  hours  of  EMD  aircraft  testing,  the  V-22 
experienced  no  mishaps;  and 

•  for  1,869  flight  hours  of  low-rate  initial  production  aircraft 
testing,  the  V-22  experienced  two  mishaps  involving  Aircraft 
Build  Nos.  14  and  18. 

The  V-22  Program  Office  provided  details  concerning  the  four  Class  A  mishaps 
and  noted  that  the  impact  forces  were  not  survivable  for  all  of  the  mishaps 
except  Aircraft  Build  No.  5.  Further,  the  Program  Office  stated  that 
developmental  aircraft  generally  have  very  few  flight  hours  compared  to  the 
number  of  flight  hours  the  aircraft  accumulates  during  deployment;  therefore, 
mishap  rates  are  generally  higher  for  developmental  aircraft.  During 
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developmental  and  operational  testing,  the  F-14A,  the  F-16A,  and  the  F-18A/B 
experienced  79,  50,  61  mishaps  per  100,000  flight  hours,  respectively.  The 
Program  Office  believes  that  using  mishap  rates  incurred  on  like  aircraft  in  the 
fleet  that  have  accumulated  significant  flight  hours,  combined  with  the  use  of 
conservative  factors,  provide  a  more  realistic  assessment. 

The  V-22  Program  Office  also  stated  that  risk  assessments  are  a  tool  to  evaluate 
risk  using  relevant  data  when  available;  however,  qualitative  factors  or 
judgment  calls  are  sometimes  the  only  way  to  induce  realism  in  the  risk 
projection.  The  Program  Office  also  stated  that  DoD  Military  Standard  882D, 
“Standard  Practice  for  System  Safety,”  February  10,  2000,  provides  that 
assigning  a  quantitative  mishap  probability  to  a  potential  design  or  procedural 
hazard  is  generally  not  possible  early  in  the  design  process.  At  that  stage, 
qualitative  mishap  probability  may  be  derived  from  research,  analysis,  and 
evaluation  of  historical  safety  data  from  similar  systems. 

Audit  Response.  The  Navy  did  not  provide  a  reasonable  analysis  to  support 
how  it  extrapolated  from  the  “efforts  conducted”  that  the  expected  level  of  risk 
for  the  V-22  EMD  test  aircraft  returning  to  flight  was  medium.  However,  the 
Navy  did  provide  mishap  rate  data  for  airplanes,  but  not  for  EMD  helicopters  to 
correlate  with  the  V-22’s  unique  operational  characteristics.  Further,  the  lowest 
mishap  rate  the  Navy  reported  for  fixed-wing  aircraft  was  50  mishaps  per 
100,000  flight  hours  for  the  F- 16 A,  which  does  not  support  the  “worst  case” 
assumption  of  2  to  10  mishaps  per  100,000  flight  hours  for  the  V-22.  In 
addition,  whether  the  impact  forces  were  not  survivable  for  all  of  the  mishaps 
except  Aircraft  Build  No.  5  is  not  relevant  to  the  “probability  of  crash” 
assumption  in  the  system  safety  risk  assessment  (Appendix  J,  page  32).  Instead, 
the  survivability  of  the  mishaps  should  be  included  with  the  “probability  that 
crash  is  survivable”  assumption. 

Although  the  Navy  cited  DoD  Military  Standard  882D  guidance  on  assigning 
mishap  probability,  it  did  not  use  crash  history  in  deriving  its  “probability  of  a 
crash”  risk  factor.  Using  a  V-22  mishap  rate  of  one  mishap  about  every 
1,200  flight  hours  (4  mishaps  in  4,947  flight  hours),  equates  to  a  mishap  rate  of 
about  83  mishaps  per  100,000  flight  hours.  Therefore,  the  projection  of 
10  mishaps  per  100,000  flight  hours  for  the  V-22  EMD  test  aircraft  was  not 
supportable  in  the  Navy’s  response  as  evidenced  by  the  V-22’s  actual  mishap 
history  and  the  mishap  history  for  the  F-14A,  the  F-16A,  and  the  F-18A/B. 

4.  Because  the  V-22  configuration  and  capabilities  are  unique,  please 
explain  why  you  used  historical  helicopter  survivability  experience  when 
establishing  the  “probability  that  a  [V-22]  crash  is  survivable”  rather  than 
historical  airplane  survivability  experience? 

Navy  Response.  The  V-22  Program  Office  stated  that  historical  helicopter 
survivability  experience  was  used  rather  than  historical  airplane  survivability 
experience  because  the  V-22,  as  a  tilt-rotor  aircraft,  incorporates  crashworthy 
features  in  critical  subsystems.  Further,  the  Program  Office  stated  that  transport 
fixed-wing  aircraft  are  not  designed  to  the  same  stringent  requirements  as  those 
imposed  on  the  V-22  and  on  all  new  light-fixed  and  rotary-wing  military 
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aircraft.  The  Program  Office  also  stated  that  high-performance,  fixed-wing 
aircraft  are  equipped  with  ejection  seats  and  do  not  share  the  same 
crashworthiness  features  or  operate  in  the  same  environment.  Similarly,  large 
multi-engine  transport  aircraft  do  not  employ  the  same  crashworthiness  features. 
Instead,  those  aircraft  rely  more  on  large  fuselage  deformation  for  energy 
reduction. 

Audit  Response.  The  Navy’s  explanation  for  using  historical  helicopter 
survivability  experience  when  establishing  the  “probability  that  a  crash  is 
survivable”  rather  than  historical  airplane  survivability  experience  seems 
reasonable. 

5.  What  was  the  source  of  the  helicopter  data  used  for  the  safety 
assessment,  what  was  the  population  and  population  size  the  data  was 
developed  from,  and  what  timeframe  does  the  data  represent?  Did  the  data 
include  helicopters  without  the  capability  to  make  an  autorotation  landing 
in  the  event  of  engine  failure?  Please  provide  a  copy  of  the  data  used. 

Navy  Response.  The  V-22  Program  Office  stated  that  autorotations  are 
performed  in  response  to  total  power  loss,  resulting  from  dual  engine  failures  in 
Navy  and  Marine  Corp  helicopters,  including  the  V-22;  or  in  response  to 
tail-rotor  failures  in  conventional  helicopters  for  which  the  vast  majority  of 
autorotations  occur.  Because  the  V-22  does  not  have  a  tail  rotor,  the  need  for 
autorotation  capability  is  reduced.  For  its  mishap  rate,  the  V-22  Program  Office 
provided  a  graph,  “Naval  Safety  Center  Data,”  as  the  data  source.  In  addition, 
the  Program  Office  listed  four  data  sources  to  support  the  “Naval  Safety  Center 
Data”  assessment. 

Audit  Response.  The  Navy  did  not  provide  the  population  and  population  size 
for  the  “Naval  Safety  Center  Data”  and  copies  of  support  data.  Further,  the 
times  given  in  the  data  sources  were  unclear  about  whether  they  were 
timeframes  of  data  or  publication  dates  of  studies. 

6.  What  was  the  source  for  the  data  used  to  develop  the  “probability  that  a 
crash  is  survivable”  factor,  what  was  the  population  and  population  size  the 
data  was  developed  from,  and  what  timeframe  does  the  data  represent. 

Why  was  only  Class  A  mishaps  represented  by  this  factor?  Please  provide  a 
copy  of  the  data  used. 

Navy  Response.  The  V-22  Program  Office  provided  data  sources  from  the 
Helicopter  Flight  Mishap  Analysis  (CY  1972-1981)  and  Class  A  mishap  data 
from  1980  to  1997  to  support  nonsurvivability  rates  of  23  and  27  percent, 
respectively,  for  its  “probability  that  a  crash  is  survivable”  factor.  The  V-22 
Program  Office  stated  that  the  Navy  risk  assessment  assumed  that  the 
survivability  rate  was  50  percent;  however,  if  the  assessment  were  adjusted  to 
show  a  survivability  rate  of  75  percent,  the  risk  level  for  the  hazardous 
condition  would  remain  a  “D”  or  remote  chance  of  occurrence. 
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Audit  Response.  The  data  that  the  Navy  provided  supported  75  percent  rather 
than  50  percent  as  the  value  for  the  “probability  that  a  crash  is  survivable” 
factor. 

7.  What  was  the  source  for  the  data  that  was  used  to  develop  the 
“probability  that  a  crash  occurs  over  land”  factor,  what  was  the  population 
and  population  size  the  data  was  developed  from,  and  what  timeframe  does 
the  data  represent?  Please  provide  a  copy  of  the  data  used. 

Navy  Response.  The  V-22  Program  Office  stated  that  the  V-22  is  a 
replacement  for  the  H-46  helicopter  and  provided  4  sources  for  data  to  support 
the  “probability  that  a  crash  occurs  over  land”  factor  of  50  percent.  The 
4  sources  showed  the  probabilities  of  water  crashes  as  47  percent,  57  percent, 

55  percent,  and  62  percent,  respectively. 

Audit  Response.  The  source  1  and  2  data  were  old,  1973  through  1984  and 
1972  though  1981,  respectively;  and  the  source  3  data  were  unclear  as  to 
whether  55  percent  of  the  helicopter  mishaps  occurred  over  water.  Further,  the 
source  4  data  were  not  for  EMD  aircraft  and  generally  supported  the 
“probability  of  crash  over  land”  factor  equating  to  50  percent. 

8.  Please  provide  evidence  that  the  factors  “probability  that  a  crash  is 
survivable”  and  “probability  that  a  crash  occurs  over  land”  are  actually 
mathematically  independent  factors. 

Navy  Response.  The  V-22  Program  office  stated  that  data  is  not  currently 
available  to  show  that  the  “probability  that  a  crash  is  survivable”  and  the 
“probability  that  a  crash  occurs  over  land”  are  totally  independent.  Further,  the 
Program  Office  stated  that  some  degree  of  statistical  dependence  may  exist; 
however,  that  degree  is  unknown.  In  the  V-22  mishaps,  three  were  land  crashes 
and  one  was  survivable.  The  V-22  Program  Office  also  stated  that  fuel  cell 
crashworthiness  would  not  have  been  a  factor  in  75  percent  (3  out  of  4)  of  the 
mishaps  because  impact  loads  far  exceeded  the  survivable  mishap  threshold  for 
humans.  Further,  the  Program  Office  stated  that  source  data  indicates  that 
20  percent  (32  divided  by  157)  of  water  mishaps  and  35  percent  (44  divided  by 
127)  of  land  mishaps  were  considered  nonsurvivable. 

Audit  Response.  The  Navy  admitted  that  probabilities  for  crashing  over  land 
and  survivability  of  crash  were  not  totally  independent.  Instead  of  using 
2  separate  factors  in  the  current  safety  risk  assessment  model  and  the  admitted 
relationship  between  crashing  over  land  and  survivability  of  crash,  the  Navy 
should  have  used  one  combined  factor  “probability  that  crash  is  over  land  and 
survivable,”  equaling  approximately  29  percent  [(127  -  44)  (127  +  157)  = 

.292],  By  presenting  two  dependent  factors  as  independent  factors,  the  Navy 
understated  the  numeric  value  of  the  safety  risk  assessment. 

9.  What  was  the  source  for  the  data  that  was  used  to  develop  the 
“probability  that  the  fuel  tank  is  compromised  during  a  crash  condition” 
factor  and  what  was  the  population  and  population  size  the  data  was 
developed  from,  and  what  timeframe  does  the  data  represent?  Please 
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provide  a  copy  of  the  data  used.  You  use  a  “probability  that  the  fuel  tank 
is  compromised  during  a  crash  condition”  factor  of  50  percent,  what  would 
be  the  factor  for  sponson  fuel  cells  that  met  the  EMD  aircraft  specification, 
and  how  did  you  adjust  that  factor  to  address  noncompliant  fuel  cells? 

Navy  Response.  The  V-22  Program  Office  provided  data  that  indicated  that  a 
fully  compliant  tank  may  be  compromised  during  a  crash  condition  from  10  to 
20  percent.  The  Program  Office  stated  that  the  50  percent  factor  presented  in 
the  equation  used  for  the  V-22  safety  risk  assessment  addresses  the  fact  that  the 
tank  is  not  a  fully  compliant  tank.  The  probability  that  an  extensible  tank  is 
compromised  would  be  a  function  of  the  magnitude  of  the  crash.  The  V-22 
Program  Office  conservatively  assumed  that  the  extensible  fuel  cells  would 
encounter  fuel  leakage  as  a  result  of  impact  velocities  above  24  feet  per  second. 
Further,  the  Program  Office  assumed,  in  conjunction  with  historically  support, 
that  approximately  50  percent  of  the  survivable  mishaps  will  have  an  impact 
velocity  of  greater  than  24  feet  per  second. 

The  V-22  Program  Office  provided  a  graph,  “Vertical  Velocity  Change,”  with 
data  from  1969  through  1981  that  referred  to  survivable  crashes  and  stated  that 
the  graph  suggests  that  only  about  30  percent  of  the  survivable  mishaps,  instead 
of  50  percent  used  in  the  risk  assessment  calculations,  occur  with  vertical 
velocities  of  about  24  feet  per  second.  Further,  the  Program  Office  stated  that, 
at  less  than  24  feet  per  second,  the  landing  gear  controls  the  deceleration. 
However,  at  greater  than  24  feet  per  second,  the  fuselage  deformation  controls 
deceleration,  which  is  somewhat  unpredictable,  but  that  does  not  mean  that  the 
fuel  tank  would  fail.  The  Program  Office  also  stated  that  the  assumption  that 
the  fuel  tank  will  fail  is  conservative  and  that  the  percentage  of  survivable 
mishaps  with  vertical  impact  velocities  greater  than  24  feet  per  second  is  also 
conservative.  Further,  the  Program  Office  stated  that  the  Aircraft  Build  No.  5 
mishap  was  a  survivable  crash  and  that  all  onboard  fuel  at  the  time  of  the 
mishap  was  recovered  from  the  sponson  fuel  tanks. 

Audit  Response.  The  Navy  did  not  present  any  direct  data  to  support  its 
assumptions  concerning  fuel  tank  compromise  during  a  crash  condition. 

Further,  the  Navy’s  vertical  velocity  change  data  is  more  than  20  years  old. 
However,  the  Navy’s  response  that  supported  its  “probability  that  the  fuel  tank 
is  compromised  during  a  crash  condition”  factor  of  50  percent  seems 
reasonable. 

10.  Is  there  any  data  available  to  be  used  as  a  basis  to  support  the 
assumption  used  for  the  “probability  that  an  ignition  source  is  present 
following  a  post  crash  fuel  spill”  factor?  If  there  is  no  data  available  to  be 
used  as  a  basis  for  this  assumption,  please  explain  the  basis  you  used  for  the 
assumption. 

Navy  Response.  The  V-22  Program  Office  stated  that  the  assumption  of  a 
100  percent  “probability  that  an  ignition  source  is  present  following  a  post  crash 
fuel  spill”  is  ultra  conservative.  Further,  the  Program  Office  stated  that,  when 
lacking  data,  system  safety  tends  to  side  towards  being  conservative,  and 
reiterated  that,  below  24  feet  per  second,  the  crash  sequence  is  controlled.  The 
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Program  Office  also  stated  that,  at  fuselage  separation  or  deformation  points, 
self-sealing  breakaway  valves  are  provided  and  that  some  crashes  beyond  24  feet 
per  second  will  not  produce  an  ignition  source  of  sufficient  energy  to  ignite  a 
fuel  source.  The  Program  Office  noted  that  the  engines,  which  are  considered 
the  primary  hot  surface  ignition  source,  are  at  the  wing  tips  and  are  not  located 
near  the  fuselage  and  sponson  tanks. 

Audit  Response.  We  agree  that  the  assumption  of  a  100  percent  “probability 
that  an  ignition  source  is  present  following  a  post  crash  fuel  spill”  is 
conservative. 

11.  Is  there  any  data  available  to  be  used  as  a  basis  to  support  the 
assumption  used  for  the  “probability  that  occupants  are  not  able  to  egress 
the  aircraft  during  a  post  crash  fire”  factor?  If  there  is  no  data  available  to 
be  used  as  a  basis  for  this  assumption,  please  explain  the  basis  you  used  for 
the  assumption. 

Navy  Response.  The  V-22  Program  Office  stated  that  the  assumption  used  for 
the  “probability  that  occupants  are  not  able  to  egress  the  aircraft  during  a  post 
crash  fire”  is  reasonable  because  the  V-22  has  seven  egress  points  and  the  flight 
test  operations  will  be  limited  to  minimum  essential  crew.  Further,  the  Program 
Office  stated  that  those  egress  points  and  the  test  operation  limitation  should 
extend  the  time  required  for  egress  in  the  event  that  the  engines  are  the  ignition 
source.  The  Program  Office  noted  that,  during  the  Aircraft  Build  No.  5 
mishap,  the  aircraft  experienced  a  post-crash  fire  and  the  crew  had  adequate 
time  to  egress  the  aircraft. 

The  V-22  Program  Office  stated  that  a  data  request  was  made  after  the  initial 
submittal  of  the  Safety  Assessment  Report  to  verify  the  assumption  regarding 
post-crash  fire  egress.  The  Program  Office  requested  data  concerning  Class  A 
and  B  helicopter  mishaps  that  occurred  from  1985  to  2002.  The  Navy 
summarized  the  data  it  obtained  as  follows: 

•  37  events  were  identified  involving  236  occupants; 

•  109  occupants  were  killed;  however,  the  cause  of  death,  namely 
crash  impact  or  post  crash  fire,  was  not  provided;  and 

•  127  occupants  survived  both  the  impact  and  the  post-crash  fire. 

The  Program  Office  assumed  that,  if  all  109  occupant  fatalities  were  the  result 
of  post-crash  fire  related  factors,  which  is  a  conservative  assumption,  the  data 
indicates  that  about  53  percent  (127  divided  by  236)  of  the  occupants  were  able 
to  egress  the  aircraft  and  were  not  killed  by  the  post-crash  fire.  To  illustrate  its 
point,  the  Program  Office  provided  an  example  of  an  aircraft  that  experienced  a 
post-crash  fire  in  which  the  occupants  had  adequate  time  to  egress  the  aircraft. 
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Audit  Response.  The  Navy  provided  summarized  information  and  not 
documented  data  as  requested  to  support  the  assumption  used  for  the 
“probability  that  occupants  are  not  able  to  egress  the  aircraft  during  a  post  crash 
fire”  factor. 

12.  Have  you  performed  and  documented  other  system  safety  risk 
assessments  for  the  V-22  Program?  If  you  have  performed  and  documented 
other  system  safety  risk  assessments,  please  provide  a  few  examples. 

Navy  Response.  The  V-22  Program  Office  stated  that  System  Safety  performed 
approximately  50  formal  risk  assessments  over  the  past  5  years  and  cited 
two  examples: 

•  Cross  Channel  Data  Link  Failures,  FRA-2002-01,  Jan  02 

•  Rudder  Actuator  Binding,  FRA-2002-03,  Dec  01 

13.  Why  doesn’t  the  model  consider  a  range  (sensitivity)  of  factor 
probabilities  for  the  “probability  that  occupants  are  not  able  to  egress  the 
aircraft  during  a  post  crash  fire”  factor,  “probability  that  an  ignition 
source  is  present  following  a  post  crash  fuel  spill”  factor,  “probability  that 
the  fuel  tank  is  compromised  during  a  crash  condition”  factor,  “probability 
that  a  crash  occurs  over  land”  factor,  and  the  “probability  that  a  crash  is 
survivable”  factor? 

Navy  Response.  The  V-22  Program  Office  stated  that  the  approach  used  in  the 
system  safety  risk  assessment  is  typical  of  any  analysis  conducted  by  System 
Safety.  Further,  the  Program  Office  stated  that  the  qualitative  assessment  is 
used  in  conjunction  with  the  quantitative  assessment  to  develop  a  risk  assessment 
if  sufficient  applicable  data  is  available  to  support  such  an  analysis.  The 
Program  Office  also  stated  that  it  does  not  look  strictly  at  either  historical  data 
or  reliability  numbers,  or  both,  when  assessing  risk.  Instead,  the  combination 
of  qualitative  and  quantitative  analyses  determines  risk.  Further,  the  Program 
Office  stated  that  a  sensitivity  analysis  should  not  be  necessary  if  the 
assumptions  used  are  conservative.  Therefore,  the  Program  Office  concluded 
that  quantitative  analysis  is  not  the  only  method  to  use  when  determining  risk. 

Audit  Response.  The  Navy  is  not  correct  when  it  stated  that  a  sensitivity 
analysis  should  not  be  necessary  if  the  assumptions  used  are  conservative.  A 
sensitivity  analysis  provides  the  user  of  model  results  with  information  on  the 
uncertainty  inherent  in  the  results,  regardless  of  whether  or  not  the  assumptions 
are  conservative.  Further,  the  Navy  is  inconsistent  when  it  implies  that 
quantitative  analysis  need  not  be  rigorous  because  quantitative  analysis  only 
augments  qualitative  analysis,  and  then  cites  quantitative  analysis  as  independent 
support  for  its  position.  Only  two  defensible  choices  exist  with  respect  to 
quantitative  analysis:  either  perform  it  with  sufficient  rigor  to  stand  alone  or  do 
not  perform  it. 
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V-22  Test  Program 


14.  Provide  the  planned  V-22  developmental  test  and  operational  test 
program  and  schedule  to  include  number  of  planned  flight  hours. 

Navy  Response.  The  V-22  Program  Office  stated  that  they  planned  to  perform 
approximately  2,537  flight  hours  of  V-22  developmental  testing  for 
four  aircraft: 

•  Aircraft  Build  Nos.  7  and  9,  a  combined  total  of  1,429  flight  hours; 

•  Aircraft  Build  No.  8,  a  total  of  548  flight  hours;  and 

•  Aircraft  Build  No.  10,  a  total  of  560  flight  hours. 

Audit  Response.  The  Navy’s  response  identified  the  estimated  number  of 
planned  developmental  flight  hours;  however,  the  Navy  did  not  provide  the 
planned  V-22  developmental  test  and  operational  test  program  and  schedule,  as 
requested,  so  that  we  could  evaluate  the  technical  risks  the  aircraft  would  be 
subjected  to  during  the  remaining  testing. 

The  “V-22  Long-Term  Schedule”  in  the  “V-22  Program  Status  Report  to 
Congress,”  April  2002,  shows  that  EMD  aircraft  will  be  used  in  flight  testing 
through  2007.  Further,  the  “V-22  Developmental  Flight  Test  Schedule”  in  the 
report  shows  that  the  flight  testing  will  include  tests  of  formation  flying  and 
handling  qualities.  However,  if  those  tests  are  conducted  in  a  low-risk 
environment,  as  discussed  in  the  system  safety  risk  assessment,  the  Navy  will  not 
be  able  to  fully  meet  developmental  test  requirements  to  verify: 

•  the  status  of  technical  progress, 

•  whether  design  risks  have  been  minimized,  and 

•  the  achievement  of  contract  technical  performance. 

15.  Will  the  EMD  aircraft  be  used  for  the  operation  test  and  evaluation? 

Navy  Response.  The  V-22  Program  Office  stated  that  it  would  not  conduct 
operational  test  and  evaluation  with  EMD  aircraft;  however,  operational  test 
pilots  will  participate  in  the  EMD  program.  Further,  the  Program  Office  stated 
that  a  Lot  4,  LRIP  aircraft,  will  be  the  first  operational  test  and  evaluation 
aircraft,  and  it  will  have  nonextensible  fuel  cells  that  passed  qualification 
testing. 

Audit  Response.  Although  the  EMD  aircraft  may  not  be  used  in  operational 
testing,  the  Navy  still  must  rigorously  test  the  EMD  aircraft  to  ensure  that  the  V-22 
aircraft  is  ready  for  operational  testing. 
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16.  How  long  would  the  V-22  developmental  test  and  operational  test 
program  schedule  be  delayed  if  compliant  fuel  cells  were  installed  in  the 
EMD  aircraft? 

Navy  Response.  The  V-22  Program  Office  stated  that,  if  compliant  fuel  cells 
were  installed  in  the  EMD  aircraft,  the  V-22  developmental  test  and  operational 
test  program  schedule  would  be  delayed  6  to  8  weeks  per  aircraft  once  all 
material  is  received. 

17.  Provide  a  copy  of  the  waiver  for  the  acceptance  of  the  EMD  aircraft 
installation  of  noncompliant  sponson  fuel  cells. 

Navy  Response.  The  V-22  Program  Office  stated  that  a  waiver  related  to  fuel 
cells  for  the  EMD  aircraft  does  not  exist  and  that  the  Government  never 
officially  bought  those  aircraft.  Further,  the  Program  Office  stated  that 
Bell-Boeing  maintains  configuration  control  with  Defense  Contract  Management 
Agency  and  Naval  Air  Systems  Command  oversight  for  flight  clearances  and 
airworthiness  certification. 

18.  Has  the  sponson  fuel  cell  qualification  test  report  (for  the  EFC 
[Engineered  Fabrics  Corporation]  manufactured  cells)  been  reviewed  and 
approved  by  the  Fuel  IPT  [integrated  product  team]?  If  not,  why  not,  and 
when  will  the  test  report  be  reviewed  and  approved? 

Navy  Response.  The  V-22  Program  Office  stated  that  the  sponson  fuel  cell 
qualification  test  report  for  the  fuel  cells  manufactured  by  Engineered  Fabric 
Corporation  has  been  reviewed  and  approved. 

Audit  Response.  The  Navy  did  not  indicate  who  reviewed  and  approved  the 
sponson  fuel  cell  qualification  test  report. 

19.  How  do  you  reconcile  the  system  safety  risk  assessment  contention  that 
the  EMD  aircraft  testing  will  be  conservative,  and  the  EMD  aircraft  will 
have  limited  exposure  compared  to  fleet  aircraft  resulting  in  low  risk  EMD 
aircraft  flights,  with  a  testing  program  that  requires  testers  to  adequately 
validate  the  aircraft  design  improvements  and  determine  the  aerodynamic 
characteristics  and  operational  limitations  of  the  V-22  aircraft? 

Navy  Response.  The  V-22  Program  Office  discussed  EMD  flight  testing, 
instrumentation,  and  maintenance  intervals  in  its  response. 

EMD  Flight  Testing.  The  V-22  Program  Office  stated  that  EMD  flight 
testing  will  be  conducted  in  a  controlled  environment  with  substantial  build-up 
or  prerequisite  testing  and  planning.  Further,  the  Program  Office  stated  that 
flight  test  plans  include  a  broad  range  of  engineering  competencies  and  must  be 
approved  before  beginning  flight  testing  of  developmental  aircraft.  The 
Program  Office  also  stated  that  flight  test  plans  can  be  subject  to  the  equivalent 
of  hundreds  of  years  of  flight  test  and  risk  management  experience  before  they 
get  to  the  final  review  stage.  Further,  risks  are  carefully  considered  and 
mitigated  to  the  greatest  degree  possible. 
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Instrumentation.  The  V-22  Program  Office  stated  that  instrumentation 
provides  data  in  the  form  of  real  time  telemetry  to  the  flight  test  team  for  the  test 
aircraft.  Further,  the  Program  Office  stated  that  aircraft  response  and 
airworthiness  is  often  observed  real-time  by  flight  test  engineers,  who 
communicate  with  test  crews  to  provide  them  with  situational  awareness  and 
professional  knowledge  that  is  not  available  to  the  fleet  pilot.  The  Program 
Office  also  stated  that  flight  test  engineers  routinely  abort  a  flight  when  an 
aircraft  limit  is  exceeded,  thereby  limiting  exposure  of  a  flight  test  crew  to  an 
unsafe  condition.  In  contrast,  the  fleet  operational  pilots  do  not  operate  in  this 
relatively  pristine  environment  and  are  not  subject  to  the  oversight  mandated  by 
the  integrated  test  team. 

Maintenance  Intervals.  The  V-22  Program  Office  stated  that,  within 
flight  test  organizations,  maintenance  intervals  are  much  more  frequent  than 
would  be  seen  for  a  fleet  aircraft.  Further,  the  Program  Office  stated  that  the 
amount  of  oversight  and  scrutiny  placed  upon  daily  aircraft  operations  is  greater 
than  what  would  be  typical  of  fleet  operations. 

Audit  Response.  Although  the  measures  described  by  the  Navy  are  risk 
abating,  EMD  aircraft  tests  to  identify  undetermined  technical  characteristics 
and  the  extent  to  which  the  V-22  can  meet  mission  needs  would  need  to  test  the 
limits  of  the  aircraft.  To  adequately  test  such  characteristics  and  limitations 
would  not  seem  to  be  “conservative”  or  low  risk. 

Further,  the  Navy  substantiated  the  higher  risks  expected  during  developmental 
testing  in  their  response  to  Issue  3  when  the  Program  Office  stated  that 
developmental  aircraft  generally  have  very  few  flight  hours  compared  to  the 
number  of  flight  hours  the  aircraft  accumulates  during  deployment;  therefore, 
mishap  rates  are  generally  higher  for  developmental  aircraft.  Accordingly,  the 
Navy’s  position  that  the  developmental  aircraft  testing  will  be  conservative  and 
have  limited  exposure  compared  to  fleet  aircraft  resulting  in  low  risk  EMD 
aircraft  flights  is  not  defendable.  Developmental  testing  facilitates  design 
maturation,  determines  unknown  technical  boundaries,  establishes  the  extent  to 
which  the  aircraft  meets  the  mission  needs,  and  determines  operational 
limitations  so  that  that  operational  aircraft  and  crew  members’  exposure  to  risks 
will  be  minimized.  Developmental  aircraft  need  to  test  and  define  performance 
bounds  and  operational  aircraft  need  to  have  operational  limitations  stemming 
from  the  results  of  the  developmental  testing. 


Conclusion 


Based  on  the  data  that  the  Navy  submitted  on  July  12,  2002,  to  support  the 
May  24,  2002,  System  Safety  Risk  Assessment,  we  again  concluded  that  the 
methodology  used  to  make  the  assessment  was  flawed.  Specifically,  the  Navy 
made  assumptions  concerning  the  “probability  of  crash,”  the  “probability  that 
crash  is  survivable,”  and  the  “probability  that  the  crash  occurs  over  land”  that 
were  not  adequately  supported  in  the  documentation  provided.  Consequently, 
the  System  Safety  Risk  Assessment  that  the  Navy  prepared  did  not  support  the 
basis  for  assessing  the  safety  risk  as  “  ID  (medium)  risk”  (undesirable  risk) 
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rather  than  “high  risk”  (unacceptable  risk),  the  next  higher  level  of  safety  risk. 
Using  the  crash  frequency  probability  data  that  the  Navy  did  provide  and 
adjusting  for  the  revised  methodology,  the  safety  risk  assessment  code  would 
increase  from  undesirable  or  a  medium  safety  risk  to  unacceptable  or  high  safety 
risk. 
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Under  Secretary  of  Defense  for  Acquisition, 
Technology,  and  Logistics  Comments 


THE  UNDER  SECRETARY  OF  DEFENSE 

3010  DEFENSE  PENTAGON 
WASHINGTON,  DC  20301  3010 

0  7  OCT  mi 

MEMORANDUM  FOR  DEPUTY  INSPECTOR  GENERAL 

SUB  JECT:  Report  on  Fuel  Cells  of  the  V-22  Osprey  Joint  Advanced  Vertical 
Aircraft  (Project  No.  D2002AE-00d5.001) 

This  responds  to  your  August  23 *  2002,  draft  report  on  fuel  cells  for  the 

V-22. 

You  recommended  that  I:  l)  reconsider  my  decision  to  fly  EMD  test 
aircraft  without  sponsor]  fuel  cells  that  comply  with  crashworthy  standards,,  and 
2)  establish  procedures  to  ensure  that  system  safety  risk  assessments  use  a  relevant 
methodology  and  are  fully  supported  and  documented,  I  have  reconsidered  both 
recommendations. 

After  careful  consideration,  1  have  again  concluded  that  the  benefits  of 
continuing  to  fly  to  address  my  other  technical  concerns  outweigh  the  limited  risk 
reduction  attained  by  stopping  the  flight  test  program  and  retrofitting  fuel  cells 
with  greater  crashworthiness  on  the  four  EMD-only  aircraft. 

I  agree  that  the  procedures  used  by  the  Services  to  assess  risk,  including 
calculations  of  risk  probability,  should  use  relevant  methodology  and  be  fully 
supported  and  documented,  Wc  will  ensure  that  the  Service  safety  organizations 
review  their  procedures,  and  update  them,  as  appropriate 


cc: 

Deputy  Director, 

Acquisition  Management  Directorate 
DUSD  (J&E) 


AC&UIUTlOhr. 

TeCHNOLOC* 

AND  LQ-5i5TI.es 
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